Hello, we need to capture webhooks (orders data) into a Boomi middleware API. However, our customer doesn’t want to allow any IP access to the Boomi APIs unless they are Shopify-verified ones. We need to whitelist Shopify’s IP ranges to allow the webhooks to our internal servers. Do you know how Shopify is managing this? Or how can we unblock only specific IPs?
Thanks,
Polo Jiménez
As of today Shopify doesn’t seem to provide a range of IP addresses that can be whitelisted. More context can be found in this response, which is from a few years ago but still relevant today.
Hey man @polo.jimenez
Unfortunately, Shopify does not provide a fixed or reliable list of IP addresses for webhooks. The IPs can change at any time, so IP allowlisting is not recommended and will eventually break webhook delivery.
The correct and supported way to secure Shopify webhooks is by using HMAC verification. This is Shopify’s officially recommended and reliable security method.