On November 12, Shopify starts blocking apps that missed its new security rule. Is one of them running your store?

Shopify just made IP allowlists mandatory for public apps (bulk ops blocked Nov 12, delisting Nov 20) and every public app must move to expiring tokens by January 1 — or stop working on April 1. TokenReady audits every app installed on your store against both deadlines, chases each vendor for written confirmation, and hands you a replacement plan for any app that won't make it. Fixed price. No tokens, no passwords, no store access beyond screenshots you choose to share.

The done-for-you Shopify installed-app security-deadline audit for merchants — every public app you run checked against Shopify's new IP-allowlist mandate and the January 1, 2027 expiring-token deadline, with a vendor chase pack and a replacement plan before an app you depend on silently stops working. Readiness and documents only; Shopify and each vendor decide compliance.

Pricing — fixed price, paid via Stripe

Try the checker

After purchase, send your case data as JSON matching checker/example-case.json. The readiness checker runs at POST /api/check and returns a scored markdown report. Health: GET /api/health.

Example report (from the shipped example case)

# TokenReady Report — Example Store (mixed stack)

**Readiness score: 50/100 — AT RISK**

Apps reviewed: 4 | In scope (public, Admin API): 3 | Exempt: 1

⚠️ CRITICAL bulk-ops apps without an IP allowlist (blocked 2026-11-12): Legacy Fulfilment Sync

## ERP Sync Pro — 100/100
- Compliant on both requirements

## Legacy Fulfilment Sync — 0/100
- IP allowlist NOT confirmed enabled — BULK OPS BLOCKED from 2026-11-12
- Still on NON-EXPIRING offline token — delisted 2027-01-01, API 403 on 2027-04-01
- No written vendor confirmation on file
- Non-compliant with NO replacement/contingency identified

## Reviews Widget — 50/100
- Token type UNKNOWN — check Settings > Apps / vendor; unknown is treated as at-risk
- No written vendor confirmation on file

## In-house Connector — 0/—
- EXEMPT: custom/merchant-created app — out of scope for both requirements

## Deadline ladder (Shopify, verified 2026-11-08)
- 2026-11-12 23:59 ET: bulk queries/mutations blocked for public apps without an IP allowlist
- 2026-11-20 23:59 ET: public apps without an IP allowlist delisted, blocked from new installs, flagged in merchant Settings > Apps
- 2027-01-01: public apps still on non-expiring offline tokens delisted and blocked from new installs
- 2027-01-15: merchants using non-compliant apps see admin warnings
- 2027-04-01: affected Admin API requests return HTTP 403 (existing installs stop working)

Boundary: readiness and documents only. Shopify and each app vendor decide compliance; this report guarantees no app outcome.