Building a private script for one store and building a public app that installs cleanly on thousands of stores are very different exercises. A public Shopify app has to survive OAuth, mandatory compliance webhooks, API rate limits, billing, and the App Store review process — all before it delivers a single feature. Having shipped our own public apps, here is what the engineering actually involves.
OAuth and secure session storage
Installation starts with OAuth. The merchant approves a set of scopes, and you exchange the resulting code for an access token. Two rules are non-negotiable: request the minimum scopes the app truly needs, and store the resulting tokens encrypted. Over-broad scopes slow down review and scare merchants; leaked tokens are a security incident. The token is the key to that store — it is treated accordingly.
The mandatory GDPR webhooks
Every public app, whether or not it touches customer data, must implement three compliance webhooks. Skipping them fails App Store review outright:
customers/data_request— return the data you hold on a customer.customers/redact— delete a specific customer’s data.shop/redact— delete a shop’s data after uninstall.
Like all webhooks, each one is HMAC-verified before it is trusted. These are not busywork — they are the difference between an app that passes review and one that does not.
Respecting the rate limits
Shopify’s Admin GraphQL API uses a calculated-cost, leaky-bucket model: every query has a cost, you have a bucket that refills over time, and exceeding it gets you throttled. A well-behaved app reads the cost information Shopify returns and paces itself instead of blindly retrying:
// throttle proactively using the cost data Shopify returns
var cost = response.Extensions.Cost;
if (cost.ThrottleStatus.CurrentlyAvailable < cost.RequestedQueryCost)
await Task.Delay(EstimateRefill(cost.ThrottleStatus));
Billing through Shopify
Charging merchants goes through Shopify’s Billing API, not a separate payment processor — recurring charges, usage charges, and free trials are all created and confirmed through it, and the subscription state lives on Shopify’s side. Building on the native billing flow means merchants pay on their existing Shopify invoice, which they trust, and you inherit its handling of upgrades, downgrades, and cancellations.
Embedding in the admin
A modern app embeds directly inside the Shopify admin using App Bridge and their design system, so it looks and behaves like a native part of the platform rather than a foreign iframe. Merchants never feel like they have left Shopify, and that consistency measurably improves adoption.
What it takes to pass review
- Least-privilege scopes and encrypted token storage.
- All three GDPR webhooks implemented and HMAC-verified.
- Rate-limit-aware API access that never hammers the platform.
- Native billing and an embedded, on-brand admin experience.
Takeaway
A public Shopify app is a real distributed system with a compliance surface, not a quick script. Getting OAuth, the mandatory webhooks, rate limiting, and billing right is what separates an app that ships and stays installed from one that stalls in review. We build and publish Shopify apps — you can see two of ours live on the Shopify App Store, and we would be glad to build or rescue yours.