Shopify app review checklist: what Shopify checks before approval

OAuth runs before anything else on install and reinstall
The merchant cannot reach your UI before OAuth completes, and after they accept the permissions they land in your app UI. Shopify docs
The embedded app authenticates with session tokens
No third-party cookies or local storage for auth, and backend routes validate the session token on every request. Shopify docs
The latest App Bridge loads from Shopify's CDN script tag
app-bridge.js is the first script in the page, not an old npm package version. Shopify docs
The three mandatory privacy webhooks are subscribed and answered
customers/data_request, customers/redact and shop/redact are declared in shopify.app.toml and return a 200-series status. Shopify docs
Every webhook is verified with its HMAC signature
The X-Shopify-Hmac-SHA256 header is checked against the raw request body, and a delivery that fails is rejected. Shopify docs
All charges go through Shopify's billing
Plans and charges use Shopify App Pricing or the Billing API, and the billing flow has been tested on a development store. Shopify docs
The app asks only for the access scopes it uses
Each requested scope maps to a feature; unused or broader scopes are removed. Shopify docs
Protected customer data access is requested before it is read
If the app reads customer names, emails, phones or addresses, the protected customer data request is approved first. Shopify docs
New public apps call the GraphQL Admin API, not REST
Shopify has required GraphQL for new public App Store apps since April 2025. Shopify docs
Storefront features use theme app extensions
App blocks and app embeds instead of editing theme files through the Asset API or injecting ScriptTags. Shopify docs
The app installs and runs without errors
No failed installs, broken screens or console errors in the flows a reviewer will try. Shopify docs
The app does not slow the storefront
Installing it does not drop the store's Lighthouse performance score by more than 10 points. Shopify docs
The app is served over a valid TLS certificate
Every app URL, including webhook endpoints, has a certificate with no errors. Shopify docs
The listing describes only what the app does
Features, screenshots and the icon (1200 x 1200 px) match the submitted app. Shopify docs

0 of 14 pass

Left to fix before you submit:

OAuth runs before anything else on install and reinstall
The embedded app authenticates with session tokens
The latest App Bridge loads from Shopify's CDN script tag
The three mandatory privacy webhooks are subscribed and answered
Every webhook is verified with its HMAC signature
All charges go through Shopify's billing
The app asks only for the access scopes it uses
Protected customer data access is requested before it is read
New public apps call the GraphQL Admin API, not REST
Storefront features use theme app extensions
The app installs and runs without errors
The app does not slow the storefront
The app is served over a valid TLS certificate
The listing describes only what the app does

Want us to fix what fails?

Our fixed-price Shopify app fix takes one bug or one failing review item in your app, in 6 working days:

A written scope of the one fix, including any access scope, webhook, billing or extension change it needs.
A failing test that shows the problem, reproduced on your development store, never your live store.
The smallest change that makes the test pass, as a pull request to your repository, checked by a separate reviewer.
A Shopify review check on the change: scopes, privacy webhooks, HMAC and session checks, billing and extension config.
A handover note with the release steps you run; you merge, release and submit to Shopify.

Book the Shopify app fix Our services

Not affiliated with Shopify. This checklist does not guarantee approval.

Will your Shopify app pass review?

0 of 14 pass

Want us to fix what fails?