Shopify announced on 5 November that merchants can review more about their connected apps under Settings → Apps. The list now shows recent activity and highlights security issues that may need attention. Open an individual app to see its access, permissions and activity together. Shopify flags permissions that may cover sensitive data.

Merchants can also see whether an app uses access tokens that expire or restricts Shopify API requests to approved IP addresses. Expiring tokens limit how long a stolen credential could remain useful. IP restrictions narrow where requests can originate. These indicators help merchants ask better questions about an app, but they do not tell you whether its access is appropriate for your store.

A practical review starts with one app your team uses for fulfilment, marketing or reporting. Check which workflow depends on it and whether the permissions fit that job. If access looks broader than expected, ask the provider which feature needs it. Check dependencies before disconnecting an app, particularly if it handles orders or inventory.