Security measure for Shopify App Proxy

Retired Boards Appdev Store Design

Topic summary

Focus: securing a Shopify App Proxy setup that forwards storefront requests to an external app server.

Key questions raised:

  • Is there a published/static IP range for Shopify’s App Proxy so the backend can allowlist only those source IPs?
  • Can the App Proxy inject a custom HTTP header into forwarded requests to help the app server verify the request origin?

Context: A security team requested additional safeguards for incoming proxy traffic to the app backend.

Notes: “App Proxy” is a Shopify feature that routes certain storefront paths to an external app and returns the app’s response on the storefront.

Status/outcome: No answers or decisions yet; guidance on IP allowlisting and header customization is still needed.

Summarized with AI on December 31. AI used: gpt-5.
1

We are using app proxy to redirect the shopify frontend request to the app server. however. We have the security team suggesting if there is anyway to safe guard those requests by the following.

  1. is there any ip range of the app proxy servers such that we only whitelist those source ip?

  2. is it possible for us to add a custom header to the request at the app proxy?

Thanks.