Shopify Plus merchants · Through November 20
Know what breaks on November 12, before it does.
Shopify has given every public app on your store until November 12 to lock down Admin API access, November 20 to stay installable and January 1 to move to expiring tokens. Your custom integrations get no deadline and no flag, which means nobody is checking them but you.
We find every app, integration and login that touches your Admin API, show you where each one stands, and hand you the fixes ranked by date.
- $2,500 flat per store
- Read-only
- Findings within 48 hours of access
- November 12 Public apps without an IP allowlist lose bulk operations
- November 20 Apps without an allowlist are delisted and flagged in your admin
- January 1 Apps still on non-expiring tokens are delisted and flagged
- April 1, 2027 Apps missing either control lose Admin API access
The mandate
What Shopify changed.
On November 5, Shopify made IP allowlists mandatory for every public app, nine days after recommending them. The mandate covers the apps installed from the App Store. Custom and merchant-created apps sit outside it, and at the Partner Town Hall the same day Shopify's CISO asked everyone building custom apps to adopt the controls anyway.
| What happens | IP allowlist | Expiring offline tokens |
|---|---|---|
| Bulk queries and mutations blocked | November 12, 2026 | |
| Delisted from the App Store, no new installs | November 20, 2026 | January 1, 2027 |
| Flagged in your admin under Settings > Apps | November 20, 2026 | January 1, 2027 |
| Warning shown in your admin | January 15, 2027 | January 15, 2027 |
| Admin API requests fail and the app stops working | April 1, 2027 | April 1, 2027 |
November 12
Fifteen days before Black Friday, any public app that moves data in bulk without an allowlist stops moving it. Inventory syncs, order exports, catalog imports and feed refreshes fail, and most of them fail quietly.
November 20
Settings > Apps in your admin shows which installed apps have an allowlist and expiring tokens, and flags the ones that do not. Your customers never see this. Your team should be reading it.
April 1, 2027
Apps still missing either control lose Admin API access entirely. Replacing an app wired into your fulfillment takes longer than the calendar suggests.
Custom integrations
Outside the mandate. The ERP connector, the product feed, the middleware and the script a contractor wrote are not flagged, not delisted and not checked by Shopify. A token leaked from one of them works from any machine on earth for as long as the token lives.
The scope
What the audit covers.
Six areas, one store, read-only. We look at everything that can reach your Admin API and everything that can reach your admin.
01Admin API inventory
Which apps can move your data in bulk, and which of those break on November 12
Every installed public app and custom app with Admin API access, its scopes, and which ones have run bulk operations in the last 90 days, read from the activity log.
02Deadline exposure
Which apps get flagged, which stop working, and when
Each app's IP allowlist and expiring token status as shown in Settings > Apps, mapped to November 12, November 20, January 1 and April 1.
03Custom integrations
Which integrations a leaked token would expose, and what it takes to close them
Custom and merchant-created apps: token type, allowlist status, where the integration runs, who maintains it, and Shopify's App Security Check run against any codebase you hold.
04Access
Who can get into your admin today who should not
Every staff and collaborator account, its permissions, last activity, and whether two-step authentication or passkeys are enforced.
05Storefront
What runs in front of your customers that you did not put there
Theme app extensions and every third-party domain your storefront loads, ahead of Shopify's network access requirement.
06Activity review
Whether something has already happened that you did not expect
The last 90 days of the activity log: bulk exports, metafield changes, collaborator logins, app installs and uninstalls.
The deliverable
What you receive.
One memo, one readout, one estimate. Nothing on your store changes until you say so.
How it works
Five steps,
one meeting.
The only step that takes your time is the third. Everything else happens on our side of the collaborator account.
01
Request
The form takes two minutes. We confirm your start date within one business day, in the order requests arrive.
Day 0
02
Approve
The collaborator request comes from MTN Haus the day we confirm. Shopify verifies our identity and shows you our business origin, login location and platform history before you approve. We request the permissions the audit needs and nothing more.
Day 1
03
Thirty minutes
With whoever owns your admin. Your integrations, the agencies and contractors who have touched the store, and anything you already suspect. This is the only meeting.
Day 1 to 2
04
Findings
The memo arrives as a PDF within 48 hours of access, with the readout already scheduled.
Within 48 hours
05
Decide
Keep the memo, revoke our access, or approve the fixes line by line.
Readout
Price and timing
One fee. No retainer.
Card at request, or invoice on request. No follow-on obligation; the fixes are a separate scope you approve line by line.
$2,500flat
Per store
$1,500each
Each additional store
48hours
From access to findings
2business days
From request to start
Through November 20
Audits are scheduled against the November 12 and November 20 dates and start within two business days of your request.
After November 20
The same audit, scheduled against the January 1 token deadline and the April 1, 2027 cutoff.
Current MTN Haus clients
This is already underway on your store this week. Your account lead will send the memo; there is nothing to request.
Read-only until you approve a fix.
The fit
Who it is for.
Mid-market and enterprise merchants on Shopify Plus, which in practice means a store with most of the following:
- An ERP, OMS, WMS or 3PL connector moving orders and inventory in bulk
- Product, marketplace or retail-media feeds refreshing on a schedule
- More than ten apps with Admin API access, several of them installed before anyone on the current team arrived
- Collaborator accounts left over from past agencies, freelancers and contractors
- No platform engineer on staff whose job is to know which of those break on November 12
Not for everyone
Who should not buy it
A single store running a handful of App Store apps and nothing custom does not need us. Open Settings > Apps in your admin, read the security column, remove what you do not use, and do it before November 12.
Why MTN
Not a checklist.
The team that builds this.
MTN Haus is a Shopify Platinum Partner, one of roughly 33 in the United States, and reached that tier from Plus partner in 18 months. Based in Denver and Central Ohio, with development, creative and sales delivery in house and phishing-resistant authentication across the team.
01
We build what we audit
The ERP connectors, product feeds and custom apps this audit inventories are what our development team writes and maintains for the brands below. We read the code and the token handling, not just the admin.
02
Verify us before you let us in
Shopify checks our identity and shows you our business origin, login location and platform history beside the collaborator request. Our own posture is already done, allowlists and expiring tokens on every custom app we maintain and App Security Check on every deploy, and it shows in each client's admin under Settings > Apps.
03
The fix is in the same building
A finding on November 12 only matters if it is closed before the date. The team that writes the memo configures the allowlists, migrates the tokens, replaces the delisted apps and cleans up access: 53 full-time people with development in house, and no handoff.
Every memo is reviewed by Kris Warner, founder and technical lead, before it goes out.
Questions
What operators ask first.
The questions that come up on every intro call, answered before the call.
What access do you need?
Collaborator access with permission to view apps and channels, users, and the activity log. Nothing is written. You can revoke it the day the memo arrives, and Shopify's collaborator screen shows you exactly which permissions we asked for.
Will anything change on my store?
No. The audit is read-only. The fixes are a separate scope with their own estimate, and nothing is touched until you approve it in writing.
Can we do this ourselves?
Yes. Settings > Apps shows each app's allowlist and token status, and the activity log shows what each app has done. The audit is for teams that do not have the hours before November 12, or that want a second set of eyes on integrations nobody on the current team built.
What is an IP allowlist?
A list of the network addresses an app's Admin API requests are allowed to come from. Shopify refuses requests from anywhere else, so a token stolen from the app is useless on an attacker's machine.
What is an expiring offline token?
An app credential that lasts about an hour instead of indefinitely. A leaked token stops working before anyone can do much with it.
We are not on Plus. Does this apply?
The audit applies to any store with custom integrations or more than a handful of apps. The price is the same.
Do you fix what you find?
Yes, as a separate scope. The memo carries the estimate for configuring allowlists and expiring tokens on integrations you own, replacing apps that will not comply by April 1, and cleaning up access, so you can approve each line or hand it to your own developer.
Can you audit an integration we built ourselves?
Yes. With access to the source we run Shopify's App Security Check against it and read how it stores and uses tokens. Without the source we audit what the admin and the activity log show.
What happens after November 20?
The same audit, scheduled against the January 1 token deadline and the April 1, 2027 cutoff when non-compliant apps lose Admin API access.
Start here
Request the audit.
Two minutes, no account to create. We confirm your start date within one business day, in the order requests arrive, and the collaborator request follows the same day.
Response
< 1 business day
Fee
$2,500 flat
Access
Read-only
Findings
48 hours from access
- Shopify Platinum Partner
- Identity verified by Shopify on every collaborator request