How to Build a Shopify App: From Dev Store to App Store Listing

This is how to build a Shopify app that merchants can find and install: choose public distribution, create a dev store, run shopify app init and pick the React Router template, then build your screens inside App Home with Polaris and App Bridge. Before you submit, ask only for the access scopes you need, handle the three mandatory compliance webhooks, set up Shopify App Pricing and run Shopify's new security check. Registration for the Shopify App Store costs a one-time $19, and on the standard rates Shopify takes nothing from your first $1,000,000 of lifetime gross app revenue (revenue share docs).

Disclosure: ZeroRaised publishes this guide and appears in the final section. Commands, rules and fees come from Shopify's own developer docs, changelog and help centre as fetched on 21 Oct 2026. Shopify changes its tooling often, so check the linked page before you rely on a command or a fee. ZeroRaised has no affiliate deal with Shopify, and this guide makes no promise of installs or revenue from the App Store or any launch site.

TL;DR#

The CLI gives you a working embedded app in minutes. What decides whether you get listed is everything reviewers check: scopes, compliance webhooks, billing, security and the listing. Security just got more weight: on 15 October 2026 Shopify added a shopify app security check command to run before you submit (changelog), and on 20 October 2026 it asked every app developer to act on security that week (changelog).

The first decision is who the app is for:

If you want strangers to find and pay for your app, you want the first row, and the rest of this guide follows it.

What happened: Shopify shipped a security check for apps#

Shopify's changelog entry Build with confidence: Shopify AI Toolkit's security check is dated October 15, 2026. It introduces shopify app security check, "a new command in Shopify's AI Toolkit and CLI that finds security vulnerabilities in your app before attackers do." The instruction is plain: "Run it before you submit an app, and on every release".

The check covers your code, your configuration and your dependencies, and "runs locally on your development machine." Each finding gives the file and line, a severity and a fix. The changelog names React Router, Rails, Django and Laravel among the stacks it handles, for public and custom apps alike, and adds: "A clean report isn't a guarantee of security".

Five days later Shopify posted Securing your app, together, dated October 20, 2026 and flagged Action required: "We're asking every app developer to act on the steps below this week." The steps include the new scan, expiring access tokens, two-step authentication and a current emergency contact, and Shopify says it is "raising App Store security requirements".

This belongs at the top of a build guide because the scan looks for "unauthenticated routes, cross-shop data access and unverified webhooks", the same mistakes first-time makers make. Build those parts right from the first commit and the check becomes a confirmation rather than a rewrite.

Public or custom: decide before you write code#

Shopify's distribution docs are blunt: "You can't change the distribution method after you select it."

• Building for one merchant: custom distribution. No review and an install link you send yourself, but a custom app "Can't charge merchants through Shopify's app billing system", so you invoice the client directly.
• Building for many merchants: public distribution. It needs Shopify's approval and must "sync certain data with Shopify", and in return gets the App Store, Shopify's billing and the revenue share plan.
• A Shopify-hosted App Home UI extension: custom distribution only.

Two older routes are gone. Private apps were deprecated in January 2022 and converted to custom apps on January 20, 2023, and unpublished apps were deprecated on December 9, 2019 (distribution docs). A tutorial telling you to create a private app is out of date.

A public app does not have to appear in search. The help centre describes unlisted public apps, which pass the same review but "aren't displayed in the Shopify App Store search results or categories". That suits a niche tool you sell from your own site while still billing through Shopify. The same page says apps "cannot decrease your storefront's speed by more than 10 performance points".

One paying client with a clear brief: build a custom app. A product meant to keep earning: build public from the start, because the method is fixed once you select it.

Accounts, the Dev Dashboard and dev stores#

You need a developer account and a store to test on. Shopify's scaffold tutorial accepts a Partner account or a merchant account with app development permissions. For a public app use a Partner account: the App Store listing, pricing and payouts sit in the Partner Dashboard, while app records and stores sit in the Dev Dashboard.

The test store is a dev store, created with shopify store create dev or from Stores in the Dev Dashboard. From Shopify's dev store docs:

• You pick a plan: basic, grow, advanced or plus. Test on the plan your merchants use.
• --demo-data fills the store with sample data.
• Organizations are limited to 250 dev stores (dev store docs).
• Dev stores "can't be used in production or process real transactions", are always password protected, and keep the myshopify.com URL you first give them.
• With Shopify App Pricing you can select any plan of your own app at no charge, so billing can be tested here.

How to build a Shopify app with Shopify CLI and the React Router template#

Shopify's scaffold tutorial is the starting point. Older tutorials may describe a different template or commands, so work from this one:

1. Optional: install the Shopify AI Toolkit for your coding assistant. The tutorial lists Claude Code, Codex, Cursor, VS Code and others. It is also how the security check is meant to be run.
2. Run shopify app init, log in and choose Build a React Router app. The tutorial calls this template "the recommended path for most apps". Pick the organization linked to your dev store and create a new app.
3. Let the CLI set up. It creates the app in the Dev Dashboard and installs dependencies, and the project "also handles authentication for you, so you don't have to build an OAuth flow to call the GraphQL Admin API."
4. Run shopify app dev. The CLI creates a Prisma SQLite database and uses Cloudflare to open a tunnel, giving your local server an HTTPS URL.
5. Press p, install the app on your dev store and click Generate a product to confirm it can write to the store.

Google autocomplete for shopify app template still suggests Remix alongside React Router; what shopify app init offers today is React Router, so follow tutorials written for it. The tutorial also notes two exceptions: a simple custom app with no server logic can use the extension-only template, and an integration that only needs API credentials can be created in the Dev Dashboard. Your own stack works too, with Shopify's official libraries.

Three habits pay off later:

• Keep config in the repo. Scopes, webhooks and compliance topics live in shopify.app.toml, and shopify app deploy pushes them.
• Never commit secrets. Shopify's 20 October notice asks you to protect code repositories with two-step authentication for the same reason.
• Note every setup step. Review asks for a demo screencast and test credentials, and those notes become your testing instructions.

App Home: building inside the Shopify admin with Polaris and App Bridge#

Merchants meet your app in App Home, "where your app's UI lives, and where merchants go to configure settings, view data, and manage workflows", per Shopify's App Home docs. You can build it as an iframe you host, with any framework, or as a Shopify-hosted UI extension limited to Preact, a 64 KB compressed bundle and custom distribution (App Home docs). For a public app that settles it: the iframe model, which the React Router template gives you.

Inside the iframe you combine four building blocks:

• Polaris web components for the interface: buttons, forms, tables and cards that match the admin, usable with any framework.
• App Bridge web components for the admin chrome outside your frame: title bars, menus and save bars.
• APIs for toasts, modals, admin workflows through the Intents API and GraphQL Admin API queries from front-end code.
• Patterns, pre-built layouts for homepages, settings pages and setup guides, which the docs say "help your app meet Built for Shopify standards out of the box". Start with these.

The embedded experience is also a review rule. The App Store requirements say an embedded app "must function properly without relying on third-party cookies or local storage, including when accessed in incognito mode on Chrome", and ask for session tokens and the latest App Bridge. Test in an incognito window before you submit.

Access scopes: the permissions merchants see at install#

Access scopes decide what your app can read and write, and merchants grant them at install. Shopify's scope guide describes two kinds, declared in [access_scopes] in your TOML file: required scopes, granted at install, and optional_scopes, requested later. Of optional scopes, the guide says merchants "can grant or decline them, and can revoke ones they've granted."

Optional scopes suit a new app with no reviews: the install screen asks for less, and only stores that use a feature are asked for more. Rules from the same guide:

• A write scope includes read, so write_products alone covers read_products.
• read_orders covers only the last 60 days (scope guide); older orders need read_all_orders, which the App Store requirements say to request only if the app needs it.
• Orders, draft orders, fulfillments and abandoned checkouts all carry protected customer data.
• Adding required scopes later prompts merchants to approve them when they next open the app; removing scopes doesn't prompt them.

Shopify is making scopes easier to shrink. A changelog entry dated October 7, 2026 adds appDowngradeAccessScopes in Admin GraphQL API version 2027-01, letting apps swap optional write scopes for matching read scopes without losing read access.

If your app touches customer data, request access in the Partner Dashboard. The protected customer data page sets level 1 (excluding name, address, phone and email) and level 2 (including them, with data protection reviews), and approves access "if the requested data is the minimum amount required by your app". Apps on development stores only don't need a request, but the submission guide says you can't apply while under review, so do it before submitting.

Webhooks, including the three compliance webhooks#

Webhooks tell your app that something happened in a store. You declare subscriptions in shopify.app.toml, Shopify sends signed requests to your endpoint, and your app verifies the HMAC signature before trusting the payload. Unverified webhooks are one of the examples Shopify's 20 October notice gives of what its scan looks for.

Three webhooks are mandatory. Shopify's privacy compliance page says any App Store app "must respond to data subject requests, regardless of whether the app collects personal data."

From the same page: respond with a 200 series status code, complete the action within 30 days unless the law requires you to keep the data, and return 401 Unauthorized if the HMAC header is invalid (compliance docs). Skip them and "your app will be rejected". One [[webhooks.subscriptions]] entry in the TOML lists all three compliance_topics. Add it on day one and test it by uninstalling from your dev store.

Security work to finish before you submit#

Run the security check. In your app folder, run shopify app security check, or with the AI Toolkit ask your agent to "Check my app for common security vulnerabilities", as the October 15 changelog suggests. Fix critical and high severity findings first, then rerun on every release.

Use expiring offline access tokens. Offline tokens cover "background tasks such as webhooks and scheduled jobs". Shopify's token docs say new public apps already can't use non-expiring ones for GraphQL Admin API requests, and all public apps must switch by January 1, 2027. An expiring token lasts 1 hour and its refresh token 90 days when issued; read expires_in rather than hard-coding it.

Lock down the accounts. The October 20 notice asks for two-step authentication on your Partner account, hosting, CDN, code repositories and email, and an emergency contact that "reaches someone who can act quickly." For a solo maker, that is your phone.

Check the install flow. The App Store requirements say the app must authenticate with OAuth immediately after install, never ask merchants to type their myshopify.com URL, and redirect to the app UI. Test a fresh install and a reinstall.

Charging merchants: Shopify App Pricing, the Billing API and revenue share#

The App Store requirements say "Apps that use off-platform billing cannot be distributed through the Shopify App store", unless Shopify has told you otherwise; charges must go through Shopify App Pricing or the Shopify Billing API. Your own Stripe checkout is out.

Use Shopify App Pricing. The billing overview, which shows no date, calls it "the default for new public apps" and labels the Billing API route Manual Pricing (Legacy). Shopify's changelog entry dated May 12, 2026 made the switch: "The Billing API continues to function but is now legacy. All apps should use Shopify App Pricing going forward." Managed Pricing "has been renamed to Shopify App Pricing" (App Pricing docs), so older guides mean the same thing.

With App Pricing your app doesn't create charges. It checks for an active subscription, sends merchants without one to the hosted plan page, and reports usage if you bill by usage; a $0 private test plan allows testing (App Pricing docs). The billing overview advises simple pricing, few plans, free trials and the merchant's local currency. For the price, see how to price a SaaS product.

What Shopify takes#

Per the same page, the $1,000,000 threshold "is a lifetime amount" and counts across all your Associated Developer Accounts, which you must link when you register. Custom apps for a single merchant need no registration.

App Store requirements and review#

Shopify's App Store requirements are the reviewers' checklist, and they "are subject to change". Rules that catch first-time makers:

• New public apps must use only the GraphQL Admin API, as of April 1, 2025 (requirement 2.2.4), so skip REST examples.
• The app must have a UI and be free of errors, even minor ones.
• Review requests must be neutral; incentives or withheld features in exchange for reviews are forbidden.
• Pricing belongs only in the listing's Pricing details, never in images or the icon, and the listing can't carry unsupported stats, guarantees or testimonials.

Our Shopify App Store launch page covers registration and the submission steps one by one, so here is the summary: register and pay the fee, complete the configuration, create a listing, pass the automated checks and submit. Have this kit ready first:

The submission guide says the automated checks "must be run and completed successfully", and that errors, beta versions or incomplete submissions "can delay the process or cause your app not to be approved." It also lists ways to get temporarily suspended from submitting, including failing to fix reviewer issues "after two or more exchanges" and resubmitting with growing numbers of issues. Test every listed feature on a fresh dev store, add noreply@shopify.com to your allowed senders and answer reviewer emails quickly.

Built for Shopify: a later goal, not a launch requirement#

Built for Shopify is Shopify's top quality status. The overview lists the benefits: a badge on your app card, a highlight on your listing, a search filter merchants can use, a search ranking boost and priority review for your future apps. You apply from the Distribution page once the prerequisites are met, and an app that fails the same criterion three times in a row can't reapply for three months.

You can't earn it at launch. The criteria page asks for at least 50 net installs from active shops on paid plans, at least five reviews and a minimum recent rating. Performance is measured in the admin at the 75th percentile: LCP of 2.5 seconds or less, CLS of 0.1 or less and INP of 200 milliseconds or less, each needing at least 100 calls over 28 days to be assessed. The design criteria ask for an app embedded with the latest App Bridge, primary workflows inside the admin, and no extra sign-up after install.

So build towards it from the start, because the template, Polaris patterns and a fast App Home cover much of it, but plan your first months around the install and review counts.

The listing and your first installs#

A new app starts with no reviews and no ranking history, so the listing does most of the early selling. Shopify's listing best practices set the shape:

• App name: 30 characters or fewer, brand first, never starting with the name of a platform you integrate with (best practices).
• App introduction: 100 characters on the merchant benefit; app details: 500 characters on what the app does and what makes it different (best practices).
• Feature list: up to 80 characters per feature, describing what merchants get rather than how it is built (best practices).
• Screenshots: 3-6 desktop images at 1600px by 900px, at least one showing your app's UI, with alt text (best practices).

For App Store search, Shopify's marketing guide suggests filling every field, including optional ones, choosing a short list of keywords, not overusing them, and covering common spellings, such as both "popup" and "pop up". It also says outside traffic can help your ranking, and that limited visibility apps don't appear in search, category pages or Trending apps.

Reviews come next. Shopify's review docs say only merchants who have your app installed can review it, or within 45 days of uninstalling, and that positive reviews lift your app in search and category pages. Ask at a natural moment, in neutral words, with no reward attached.

Where the first merchants come from, in practice:

• Shopify's own communities. The marketing guide points to the Shopify Community forums for helping merchants with real problems, with a warning to read the Code of Conduct, because promotion "might be considered as spamming behavior."
• Other Partners. Marking paid plans "Free for partners and developers" lets agencies test your app on dev stores at no charge, per the same guide.
• Your own channels and launch sites. Video tutorials, email and posts aimed at your niche bring the outside traffic the guide describes. The launch sites directory lists venues by audience, and how to sell software online covers the wider picture. If you have shipped to other marketplaces, the Chrome extension launch guide and Slack app guide follow the same pattern, and the launch checklist for bootstrapped makers covers launch week.

Where ZeroRaised fits#

Shopify's review decides whether merchants can install your app. It does not tell anyone outside the App Store that it exists.

ZeroRaised is a free launch site for bootstrapped makers whose products have no institutional VC or accelerator equity. Once your app is published and has a listing merchants can install from, you can submit it for review. The maker perks page lists separate offers for eligible makers. None of it replaces a listing that follows Shopify's rules or a merchant who leaves a fair review.

That is how to build a Shopify app, in order: pick public distribution, scaffold with the React Router template, keep scopes lean, wire up the compliance webhooks, price with App Pricing, run the security check, and submit a listing you could defend line by line.