Skip to main content

Enforced IP restrictions: Metafields Guru only reaches your store from trusted servers

· 5 min read
Field Marshal Quack
Field Marshal Quack
Commander of All Metafields at Metafields Guru

Metafields Guru now enforces an IP allowlist for its access to your store. Shopify only accepts requests made on behalf of the app when they come from our own trusted servers, and rejects them from anywhere else. Even if an access token ever leaked, it could not be used to reach your store from another machine. That shouldn't happen - we put a lot of effort into improving the app's security - but an extra layer of protection never hurts. You can see it in your Shopify admin, on the app's page under Settings → Apps, as Enforced IP restrictions, and you don't need to do anything to get it.

What's new at a glance​

  • Access only from trusted servers - Shopify rejects any request made with the app's access tokens unless it comes from our servers.
  • A leaked token is far less useful - on its own, it no longer opens a way into your store from someone else's machine.
  • Nothing for you to do - the app works exactly as before, with no reinstall or new settings.

How it works​

To read or change data in your store, an app sends requests to Shopify's Admin API using an access token. Without an allowlist, that token is the only thing Shopify checks, so it works from any computer in the world.

With an IP allowlist, Shopify also checks where each request comes from. A request from an address outside the list fails with a 403 error, even if the token is valid.

Every request Metafields Guru makes to your store's Admin API now comes from our own servers, at fixed addresses on that list.

This adds a layer of protection rather than replacing the others. Tokens are still required and permissions still apply - a request has to pass both checks to reach your store.

FAQ​

Where can I see that IP restrictions are enforced?​

In your Shopify admin, go to Settings → Apps and open Metafields Guru. In the Security section, Enforced IP restrictions is listed with the status Enforced and the description "Allows access to store from trusted servers".

Do I need to change anything in my store?​

No. The allowlist is part of the app configuration on our side, so there is nothing to reinstall, approve, or set up.

Will this block me if I work from a new location or a VPN?​

No. The restriction applies to the requests our servers send to Shopify, not to your own connection.

Does this affect my other Shopify apps or my own custom apps?​

No. Each app has its own allowlist, and this one only covers access tokens issued to Metafields Guru.

Is an IP allowlist required by Shopify?​

Yes, for public apps. Shopify is phasing in the requirement, with the first restrictions starting on November 12, 2026 and Admin API access ending for apps without an allowlist on April 1, 2027. Metafields Guru already meets it, so none of those restrictions apply to the app.

Questions?​

Our support team is always happy to help with anything related to this update. New to the app? Install it from the Shopify App Store or start with the introduction.