App security updates: IP allowlist is now required
The IP allowlist is now required for every public app by November 20, or November 12 if you use bulk ops. ASN support covers serverless hosting. Plus token updates.
November 2026
SurfaceOctober 2026
Surface- Breaking changesCustomer Account APIcurrententrychange now returns the previous page in event.from for customer account full-page extensions
- Breaking changesAdmin REST APIGift Card line_item_id will become read-only in REST Admin API version 2027-01
- Payments Apps APINew trusted vault origin signal in Payments Apps API
- GraphQL Admin API
FulfillmentOrderDestinationnow includesprovinceCode - App Events APIApp Events: Send events from Checkout and Customer Account UI extensions
- Breaking changesAdmin REST APIManaged mode for Shopify Tax
- GraphQL Admin APIAdd selling plans to draft order line items with the Admin GraphQL API
- GraphQL Admin APIUnlink a customer's identity provider subject with the GraphQL Admin API
- GraphQL Admin APIMetaobject analytics queryable capability available in the Admin API
- GraphQL Admin APIDowngrade app access scopes from write to read
- Breaking changesGraphQL Admin API
metafieldIntegercollection condition removed in API version 2027-01 - Breaking changesGraphQL Admin APITax webhook summary and calculation requests now use Global IDs
September 2026
SurfaceMay 2026
Surface