To be listed in the Shopify App Store in 2026, an app must meet Shopify's App Store requirements: the policy rules (the Partner Program Agreement, Shopify billing, honest reviews), functionality (session tokens, the GraphQL Admin API, the latest App Bridge, OAuth straight after install), security (valid TLS, only the access scopes it needs), an accurate listing, and the rules for its category. Built for Shopify is a separate, higher status with extra criteria for installs, reviews, performance, admin integration and design.
We've taken seven of our own apps through App Store review: BulkPerk, Importly, Surchify, Heartify, Backly, Loya and Merit. This guide is the checklist we work from. We checked every requirement against shopify.dev in October 2026, and the last section lists what changed in 2025 and 2026.
Shopify App Store requirements at a glance
Shopify numbers its requirements, which makes reviewer feedback easier to trace. The numbers below match the App Store requirements page on shopify.dev.
| Area | What Shopify requires | Requirements |
|---|---|---|
| Policy | Comply with the Partner Program Agreement, stay inside Shopify's core systems, bill through Shopify App Pricing or the Billing API, never incentivize reviews | 1.1 to 1.3 |
| Functionality | No errors that block review, a working UI, accurate data sync, Shopify APIs, a consistent embedded experience, a clean install and reinstall | 2.1 to 2.3 |
| Security | A valid TLS certificate and only the access scopes the app needs | 3.1 to 3.2 |
| App Store listing | A unique name, pricing only in the pricing section, no statistics or testimonials, clear and unique images, a complete submission | 4.1 to 4.5 |
| Category-specific | Extra rules for online store, payments, purchase options, product sourcing, checkout, sales channels, post-purchase, mobile app builders, donations and blockchain apps | 5.1 to 5.11 |
| Privacy | Three mandatory compliance webhooks, plus approved access before using protected customer data | Privacy law compliance docs |
Shopify notes that these requirements change as the platform changes, that published apps are expected to meet new requirements as they are added, and that its App Excellence team runs quality checks on apps after they go live.
What are the policy requirements for Shopify apps?
Section 1 is about operating within the platform, not around it. The rules that most often affect real apps:
- Use session tokens (1.1.1). An embedded app must work without third-party cookies or local storage, including in Chrome's incognito mode.
- Use Shopify checkout (1.1.2). Apps that bypass checkout or payment processing aren't allowed.
- Use only factual information (1.1.4). No fake reviews and no false purchase notifications, in the app or in the listing.
- Create unique apps (1.1.5). An app can't be identical to another app you have published.
- Charge through Shopify (1.2). All app charges go through Shopify App Pricing or the Shopify Billing API. Merchants must be able to upgrade and downgrade without contacting support or reinstalling.
- Keep reviews honest (1.3). Ask for reviews only in neutral language. Offering incentives, or withholding features in exchange for a review, is forbidden inside or outside the app.
Section 1.1 also rules out whole categories, including apps that let merchants download themes, marketplaces that aren't built as sales channels, apps that connect merchants to agencies or freelancers, refunds outside the original payment processor and capital lending.
What technical requirements must a Shopify app meet?
APIs and App Bridge
- GraphQL Admin API (2.2.4). Since April 1, 2025, all new public apps must be built only with the GraphQL Admin API. The REST Admin API has been legacy since October 1, 2024.
- Latest App Bridge (2.2.3). Since March 13, 2024, apps must load the latest App Bridge by adding the
app-bridge.jsscript tag before any other script. - Admin extensions (2.2.5 to 2.2.7). Admin blocks, actions and links must be feature-complete and can't promote apps or ask for reviews. The Max modal can only open after a merchant interaction, never from the app navigation menu.
- Sidekick app extensions (2.2.8 and 2.2.9). Since June 17, 2026, tools and actions exposed to Sidekick must match what the app does and what its listing says, with no promotions or review requests.
Installation
Section 2.3 covers the install flow, and it is where many first submissions fail. The app must be installed from a Shopify surface, never by asking the merchant to type a myshopify.com address. It must authenticate with OAuth before any other step, send the merchant to the app UI after they accept the permissions, and authenticate again straight away after a reinstall. Apps configured with Shopify CLI use Shopify managed installation, which handles most of this for you.
Storefront code and performance
If an app changes the merchant's theme, it must use theme app extensions (5.1.1), not direct code edits. Script tags are on their way out:
- From October 1, 2026,
scriptTagCreateandscriptTagUpdatereturn an error in every API version. - From March 1, 2027, Shopify stops injecting script tags into storefronts.
- Replace each script tag with an app embed block in a theme app extension, or with a web pixel if it only collects analytics.
Shopify's App Store best practices add a performance target: an app shouldn't lower the store's Lighthouse performance score by more than 10 points. For apps that affect the storefront, Shopify measures the score before and after install as a weighted average of the home page (17%), a product page (40%) and a collection page (43%).
Recommended stack
Shopify recommends its React Router template for most new apps: run shopify app init and choose to build a React Router app. The admin UI is built with Polaris web components. Polaris 2.0, which matches the redesigned Shopify admin, became stable on October 22, 2026. Existing apps don't move to it automatically: you opt in by loading polaris-2.js.
What privacy and security rules apply?
Every app distributed through the App Store must respond to data subject requests, even if it stores no personal data. Shopify handles this with three mandatory compliance webhooks:
| Webhook topic | What it asks for |
|---|---|
customers/data_request | The data you store about a customer |
customers/redact | Deleting a customer's data |
shop/redact | Deleting a store's data, sent 48 hours after the merchant uninstalls your app |
Subscribe to all three in your app configuration file before you submit. The app must answer each request with a 200-series status, return 401 Unauthorized when the HMAC signature is invalid, and complete the action within 30 days unless the law requires you to keep the data. An app without working compliance webhooks is rejected. Since March 23, 2026, Shopify processes customer erasure requests 10 days after they are submitted, instead of holding them for 180 days after the customer's last order. If your data handling assumed that delay, check it.
If the app uses customer data, apply for protected customer data access in the Partner Dashboard under API access. The webhooks cover the Shopify side of privacy compliance. Your privacy policy and data handling still have to meet the laws that apply to you.
Security moved up the list in October 2026. Shopify asked every developer to scan their app with the security check in its AI Toolkit, start moving to expiring access tokens (which will soon be required for all public apps), turn on two-step authentication everywhere and keep the emergency developer contact current. Shopify also said it will raise App Store security requirements and publish the details before they take effect.
Which listing rules cause the most rejections?
Section 4 is about the listing, and its rules are strict:
- A unique name (4.1). The name must lead with your own brand identifier and can't be identical or confusingly similar to another app, developer, brand or Shopify product. It must also match between the Developer Dashboard and the listing. Shopify added rule 4.1.2 on July 15, 2026 and is auditing existing apps in waves.
- Pricing only in Pricing details (4.2). No prices in images, in the app icon or elsewhere in the listing.
- No statistics or claims (4.3.3 and 4.3.4). No data, verified or not, in the listing text or images, and no "the first", "the best" or "the only".
- No reviews or testimonials (4.3.6 and 4.3.7). Reviews appear on the listing from merchant feedback only.
- Clear, unique images (4.4.4 and 4.4.5). Images must show the app's real interface, without desktop backgrounds or browser windows. Logo-only images aren't allowed, and every image must be different. Shopify started enforcing these rules on March 26, 2026.
- No Shopify trademarks in graphics (4.4.3), except to show compatibility under Shopify's brand guidelines.
- A complete submission (4.5). Include a screencast of onboarding and the main features, in English or with English subtitles, test credentials that give access to the full feature set, and an emergency developer contact in the Partner Dashboard.
How does the Shopify app approval process work?
An app moves through a fixed set of statuses on its App Store review page:
| Status | What it means | What you do |
|---|---|---|
| Draft | The app hasn't been submitted yet | Fix every issue flagged on the review page, then click Submit your app |
| Submitted | Shopify has your submission and emails a confirmation | Wait. You can withdraw at any time |
| Paused | Core requirements prevent a reviewer from reviewing the app | Make the changes from the email and click Submit fixes |
| Reviewed | A reviewer found issues that need to be discussed | Reply to the email to continue |
| Published | The app is approved and listed | Keep meeting the requirements, because quality checks continue |
The steps we follow before pressing submit:
- Install the app on a development store and go through every feature, including install, uninstall and reinstall.
- Run Shopify's AI self-review. The Shopify AI Toolkit includes a
/shopify-app-store-reviewskill that checks your codebase against every requirement that can be tested from code. It doesn't cover the listing, live behavior or UX, so reviewers still check everything. - Clear the automated checks on the App Store review page. Since April 2025 they include immediate authentication after install, redirecting to the app UI, a clean uninstall and reinstall, the latest App Bridge, and listing checks.
- Test billing. With Shopify App Pricing, a development store in your Partner organization can select any plan at no charge. With the Billing API, create test charges with
test: true, then turn it off before launch. - Check the OAuth URLs in the active app version if you don't use Shopify managed installation.
- Prepare the submission: listing, screencast, test credentials and emergency contact.
Shopify's review docs don't promise a fixed review time. What shortens it is a submission that passes the automated checks the first time and gives the reviewer a working screencast and credentials. After launch, audit feedback for published apps appears in the Partner Dashboard under App > Distribution, the same place as submission feedback, since June 2, 2026.
Why do Shopify apps get rejected?
Shopify lists the most common review problems itself. Most of them send the app back for a full resubmission:
| Area | Common problem | Fix | Resubmit? |
|---|---|---|---|
| Billing | Wrong pricing details, no plan switching, charges outside Shopify billing | Keep pricing current, allow upgrades and downgrades, bill only through Shopify | No |
| Installation | No immediate OAuth, a fatal error after install, a broken reinstall | Test the access token flow and the redirect, test reinstalling | Yes |
| Embedding | The app switches between embedded and standalone | Use App Bridge and session token authentication | Yes |
| User interface | A broken UI after install, or 404, 500 and 300 errors | Make the UI usable and the error messages clear | Yes |
| Testing | Missing test instructions or credentials, an unfinished app | Add credentials and a screencast, submit only a finished app | Yes |
| Online store apps | No theme app extensions, widgets that don't display properly | Use theme app extensions and test widgets on the storefront | Yes |
What is Built for Shopify, and how do you qualify?
Built for Shopify is the highest status an app can reach in the Shopify App Store. It is not required to be listed. It is a quality badge with real distribution benefits:
- a Built for Shopify badge on the app card wherever it appears, and a highlight on the listing;
- a Built for Shopify search filter and a boost in App Store search ranking;
- eligibility for the first collection on the App Store homepage and category pages, the Picked for you modal in the admin, and story pages;
- since October 30, 2025, a place in the featured header of the App Store homepage and preferential positioning on some category pages;
- priority review for your future app submissions, and plan-based targeting for App Store ads.
These are the Built for Shopify requirements as of October 2026:
| Area | Requirement |
|---|---|
| Prerequisites | Meet all App Store requirements, be in good Partner standing, have at least 50 net installs from active shops on paid plans, at least five reviews and a minimum recent rating |
| Admin performance | LCP of 2.5 s or less, CLS of 0.1 or less and INP of 200 ms or less at the 75th percentile, each with at least 100 measurements over 28 days. The app must use the latest App Bridge so Shopify can collect them |
| Storefront performance | No more than a 10-point drop in the store's Lighthouse performance score |
| Checkout performance | For apps that supply carrier rates: at least 1,000 requests over 28 days, a p95 response time of 500 ms or less and a failure rate of 0.1% |
| Integration | Embedded in the admin with App Bridge, primary workflows inside Shopify, sign-up with Shopify credentials, key metrics on the app home, third-party connection settings inside Shopify |
| Installation | Theme app extensions for a clean uninstall, and no Asset API writes to theme files, except for page builders, backup tools and SEO, content locking or developer tools |
| Design | 19 criteria in three groups: familiar, helpful and user-friendly |
| Category-specific | Extra rules for 14 categories, including ads, analytics, discounts, email and SMS marketing, fulfillment, product bundles, reviews, returns and subscriptions |
The design criteria were cut from 104 to 19 in June 2025, and they are specific. Reviewers reject an app whose buttons don't match the admin, that uses its own navigation instead of the admin nav menu (s-app-nav), whose forms don't use the contextual save bar, or whose modal still uses the deprecated Polaris Fullscreen bar instead of s-app-window. On the helpful and user-friendly side, they check onboarding, a homepage with useful metrics, contextual error messages, live previews, no countdown timers or guilt-trip buttons, dismissible promotions and clearly labeled premium features.
To apply, open App distribution in the Partner Dashboard, select the app, click Distribution and then Apply now. The prerequisites are checked automatically, so the button only works once you meet them. If you fail the same criterion three times in a row, the application is suspended for three months. Built for Shopify apps are reviewed every year and get 60 days to fix any failure.
Category rules keep moving. From December 1, 2026, returns and exchanges apps and subscription apps with buyer self-service must authenticate customers with the Customer Account API, or risk losing the status.
What changed in the Shopify App Store guidelines in 2025 and 2026?
| Date | Change |
|---|---|
| January 1, 2025 | Public apps must use the new GraphQL product APIs to be accepted |
| April 1, 2025 | New public apps must be built only with the GraphQL Admin API |
| April 30, 2025 | More automated checks on the pre-submission page |
| June 1, 2025 | Simplified Built for Shopify design requirements (19 instead of 104) |
| July 1, 2025 | New Built for Shopify requirements for marketing apps |
| October 1, 2025 | Polaris web components became stable |
| October 30, 2025 | Built for Shopify apps get priority visibility in the App Store |
| December 10, 2025 | App Store requirements reorganized and numbered |
| February 27, 2026 | Updated Partner Program Agreement and API License and Terms of Use |
| March 26, 2026 | Enforcement of the new listing image rules (4.4.4 and 4.4.5) |
| May 12, 2026 | Managed Pricing became Shopify App Pricing, with usage-based charges through the App Events API |
| June 2, 2026 | Audits of published apps managed in the Partner Dashboard |
| June 17, 2026 | App Store requirements for Sidekick app extensions |
| July 6, 2026 | A dedicated rule against incentivized reviews, and stronger detection of untrusted reviews |
| July 15, 2026 | Rule 4.1.2: a unique app name, enforced gradually |
| September 29, 2026 | Tools to move existing Billing API subscriptions to Shopify App Pricing |
| October 1, 2026 | Script tags can no longer be created or updated |
| October 20, 2026 | Shopify's security call: expiring access tokens soon required, stricter security requirements announced |
| October 22, 2026 | Polaris 2.0 stable |
| December 1, 2026 | Customer Account API required for Built for Shopify returns and subscription apps |
| March 1, 2027 | Script tags stop running on storefronts |
If you only act on three of these, make them the script tag replacement, the move to expiring access tokens, and a check of your listing name and images against rules 4.1.2, 4.4.4 and 4.4.5.
How we build apps for the Shopify App Store
We've taken seven of our own apps through App Store review: BulkPerk, Importly, Surchify, Heartify, Backly, Loya and Merit. You can see them all on our apps page, and the story behind Codersy Apps explains why we build them.
When we build an app for a client, public or custom, we work from the same list: the GraphQL Admin API, the three compliance webhooks, theme app extensions instead of script tags, and an admin built with Polaris. If you're planning an app, see our Shopify custom app development service.
FAQ
What are the steps in the Shopify app approval process?
Build and test the app on a development store, clear the automated checks on the App Store review page and submit. The app then moves from Draft to Submitted. It can be Paused if core requirements block the review, or go to Reviewed if the reviewer needs fixes. Once approved, it is Published. Shopify emails you at every step, and you can withdraw at any time.
What are the requirements for Built for Shopify?
The app must meet all App Store requirements, be in good Partner standing and have at least 50 net installs from paid shops, five reviews and a minimum recent rating. It must also meet admin Web Vitals targets (LCP 2.5 s, CLS 0.1, INP 200 ms), stay within a 10-point Lighthouse drop on the storefront, be embedded in the admin, uninstall cleanly through theme app extensions and pass 19 design criteria, plus any rules for its category.
Do Shopify apps have to use Shopify billing?
Yes. Apps in the App Store must charge through Shopify App Pricing or the Shopify Billing API, unless Shopify has told you otherwise. Off-platform billing isn't allowed. One exception in the category rules: product sourcing apps charging merchants for the cost of goods must use a PCI-compliant payment gateway for those charges.
Can a Shopify app still use script tags?
Not for long. Since October 1, 2026, new script tags can't be created or updated, and on March 1, 2027 Shopify stops running them on storefronts. Move to an app embed block in a theme app extension, or to a web pixel for analytics.
Which is a requirement of the Shopify Plus certified app program?
Shopify's Help Center now describes this as the Shopify Certified Technology Partner Program. Its requirements include a dashboard or status page that shows whether your system is running, having issues or down, an on-call team with an escalation plan, a process for announcing planned downtime, an App Store listing that meets the requirements, and a rating above 4.0 after at least five reviews. Apps don't have to meet every Built for Shopify requirement, but the Built for Shopify rules for their category apply.
Can AI help an app pass Shopify review?
It can help you prepare. Shopify's AI Toolkit includes a self-review skill that checks your codebase against every App Store requirement that can be tested from code, and a security check for Shopify-specific vulnerabilities. Neither replaces the human review: listing content, live behavior and UX are still checked by Shopify's reviewers.
Building a Shopify app?
From private apps to public App Store launches, our team has shipped both. Let's scope yours.
Shopify insights, straight to your inbox
Practical notes on growing a Shopify store: conversion, speed, migrations, and what we learn from client builds.
Want more of our posts in your Google results? Add Codersy as a preferred source.
Add Codersy on Google(opens in a new tab)
