Shopify App Store requirements: getting through review

Shopify reviews every public app before it appears in the App Store, and most first submissions are rejected. Not because the bar is unreasonable, but because the requirements cover things that are easy to leave until last and then forget entirely.

If you're building for one client, none of this applies — custom apps aren't reviewed. This is the public-app path.

What review actually covers

It installs and works. A reviewer installs on a fresh store with little data and follows your instructions. If it errors on an empty store, or requires setup you didn't document, it fails here. Test on a genuinely empty store, not your development store with three years of test data.

It does what the listing says. Screenshots, description and pricing must match reality. Aspirational listings fail.

Authentication is correct. OAuth HMAC and state verified, session tokens in embedded apps, no cookie sessions in an iframe. Authentication and OAuth covers the specifics.

Scopes are justified. Every scope you request should be visibly used. Asking for customer data in a shipping app invites a question you need a good answer to.

The mandatory privacy webhooks are implemented. customers/data_request, customers/redact, shop/redact — genuinely implemented, not stubbed returning 200. This is checked, and it's the single most common rejection reason.

Performance. An app that adds meaningful weight to the storefront will be questioned. Storefront code should ship as theme app extensions, loaded lazily where possible.

Billing matches the listing. Charges created correctly, trials as described, and the merchant is never locked out of their own data when a subscription ends. The Billing API.

It handles uninstall. Access token revoked, data deleted, no continued API calls with a dead token.

The rejections I see most

1. Privacy webhooks missing or stubbed.
2. Broken on an empty store — no products, no orders, no configuration.
3. Requesting scopes the app doesn't use.
4. Listing screenshots from an older version.
5. No support contact that works. A reviewer will email it.
6. Setup instructions that assume knowledge the reviewer doesn't have.
7. The app breaks on a theme that isn't Dawn. If it touches the storefront, test across several themes.

None of these are hard. All of them cost you a review cycle, and review cycles are weeks.

The listing itself

The listing is marketing, and it's also part of what's reviewed.

• The name shouldn't imply Shopify built or endorsed it. Trademark rules here are strict and enforced.
• Screenshots should show the app doing its job, at current UI, with realistic data.
• The description should say what the app does in the first sentence, not what your company believes about commerce.
• Pricing must be accurate and complete, including what happens after a trial.
• A demo store or video helps a reviewer, and helps merchants.

Before you submit

• Install on a brand-new development store and complete the whole flow from nothing.
• Uninstall, confirm cleanup, reinstall, confirm it still works.
• Trigger every privacy webhook and confirm the behaviour is real.
• Create, upgrade, downgrade and cancel a subscription in test mode.
• Test the storefront component on at least three different themes.
• Read your own listing as a merchant who has never heard of you.
• Check the support email actually reaches a person.

Timeline

Budget weeks, not days: an initial review, at least one round of feedback, a fix, and a resubmission. Plan the launch after approval rather than announcing a date and hoping.

This is a substantial part of why a public app costs several times what the same functionality costs as a custom app — a gap covered in app development cost.

After approval

Review isn't the end. Shopify periodically re-checks listed apps, API versions rotate quarterly, and requirements change. An app nobody maintains eventually falls out of compliance and gets delisted — which is the ongoing cost that belongs in the business case from the start.

Review isn't a quality gate you sneak past. Treat the checklist as the definition of done and the submission is uneventful.