Getting Your First Shopify App Reviewed: What Reviewers Actually Check

Getting Your First Shopify App Reviewed: What Reviewers Actually Check

If you have built a Shopify app — whether for your own food business's needs or as a commercial product for the Shopify App Store — getting that app reviewed and listed is a significant milestone. Shopify's app review process is thorough. Apps that don't meet Shopify's requirements are rejected, sometimes after weeks of submission, and the rework required can be substantial if you haven't built to their standards from the start.

This guide covers what Shopify's app reviewers actually check, based on Shopify's public documentation and the experience of app developers who have been through the process.

The App Review Process Overview

When you submit an app to the Shopify App Store, Shopify's review team assesses it against their Partner Requirements and the App Store guidelines. The process typically takes 2-6 weeks for an initial review. If issues are found, you'll receive feedback and have the opportunity to address them before resubmission.

Apps are reviewed at initial listing and can be re-reviewed following significant updates or in response to merchant complaints.

What Reviewers Check: Technical Requirements

App performance. Your app must not significantly degrade Shopify store performance. Shopify uses automated performance testing and manual review. Avoid loading large, unoptimised scripts on every storefront page — only load what is necessary on pages where your app is active.

Security. OAuth authentication must be implemented correctly. API requests must be authenticated. Webhooks must be validated using HMAC. Customer data must be handled securely. Shopify reviews your OAuth flow carefully — incorrect implementations are a common rejection reason.

Shopify API compliance. Your app must use the correct API version, stay within rate limits, and use the appropriate APIs for each use case. Apps that use deprecated APIs, make unnecessary API calls, or misuse the API will be flagged.

Webhooks. Required webhooks (GDPR-related webhooks in particular — customers/redact, shops/redact, customers/data_request) must be implemented and must respond correctly. Missing GDPR webhooks is an automatic rejection.

Error handling. Your app must handle errors gracefully — API failures, network errors, and edge cases should not cause unhandled exceptions visible to merchants or customers.

What Reviewers Check: Functional Requirements

Listed functionality works as described. Reviewers will install your app on a development store and test that it does what your listing claims. If features don't work as described — including in edge cases — this is a rejection.

Onboarding experience. The process from installation to active use must be clear and achievable by a non-technical merchant. Reviewers evaluate whether setup is intuitive, whether errors are clearly communicated, and whether help documentation is linked appropriately.

Billing. If your app charges merchants, your billing implementation must use Shopify's Billing API. You cannot direct merchants off-platform for payment. Pricing must be clearly disclosed upfront.

Privacy policy and terms. Your app listing must include a link to a current, accurate privacy policy. If your app collects merchant or customer data, your privacy policy must disclose this accurately.

Uninstall cleanup. When a merchant uninstalls your app, your app should clean up after itself — remove injected scripts, clear stored data per your privacy policy, and not leave orphaned webhooks.

What Reviewers Check: Listing Quality

App name. Must be unique, not contain "Shopify" or trademarked terms (without permission), and accurately describe the app.

App description. Must accurately describe what the app does. Exaggerated claims, misleading descriptions, or descriptions that don't match actual functionality are grounds for rejection.

Screenshots and media. Must be accurate representations of the actual app UI. Placeholder screenshots or screenshots that don't match the submitted app are rejected.

Pricing. Must be accurate and clearly presented. Hidden fees or misleading pricing structures are rejected.

Common Rejection Reasons

Based on developer community reports, the most common rejection reasons are:

1. Missing or incorrectly implemented GDPR webhooks
2. OAuth implementation errors
3. App does not work as described in the listing
4. Performance impact on storefront load times
5. Billing not implemented through Shopify's Billing API
6. Privacy policy missing or inaccurate
7. Onboarding process is unclear or broken
8. Screenshots don't accurately represent the app

Building for Review Success from the Start

The best way to pass the review process is to build to Shopify's standards from the beginning:

• Read the Partner Requirements and App Store guidelines before starting development
• Implement GDPR webhooks early — they are required and commonly missed
• Test OAuth and billing flows thoroughly before submission
• Write your listing, privacy policy, and help documentation before submitting
• Test your app on a real development store from the merchant perspective before review

At SaltAI, all our apps — SafeServe, DeliveryIQ, BundleBox, ReviewPulse, and our full suite — are built and maintained to Shopify's standards. Explore the SaltAI app suite at saltai.app.

How to Use a Development Store Effectively Before Submission

Testing on a development store is not optional — it is the single most effective way to catch rejection-worthy issues before Shopify's reviewers do. Shopify provides Partners with unlimited development stores precisely for this purpose, and you should be using one that closely mirrors a real merchant's setup. Install your app fresh, as if you are a merchant encountering it for the first time, and document every step of the onboarding flow. If anything requires knowledge that a non-technical merchant wouldn't have, that is a problem you need to resolve before submitting.

Go beyond the happy path during your development store testing. Deliberately trigger error states — disconnect your backend, submit incomplete forms, attempt to use features before completing setup. Reviewers are trained to probe edge cases, and they will find broken error handling if you haven't addressed it. Your app should communicate errors in plain, actionable language rather than surfacing raw exception messages or blank screens. Every error state a merchant might encounter should guide them toward a resolution.

Pay close attention to how your app behaves across different Shopify plans and store configurations. A feature that works on a Shopify Plus store may behave differently on a Basic plan due to API access restrictions. Test with stores that have no products, stores with hundreds of variants, and stores with multiple locations if your app touches fulfilment or inventory. The closer your development store testing environment matches real-world merchant diversity, the fewer surprises you will encounter during the formal review.

Understanding Shopify's Embedded App Requirements

If you are building an embedded app — one that lives inside the Shopify admin rather than as a standalone external tool — there are additional requirements that reviewers will specifically assess. Your app must use Shopify App Bridge correctly to render within the admin iframe environment. Navigation, modals, toasts, and loading states should all use App Bridge components where available, rather than custom implementations that break the embedded experience. Reviewers will notice immediately if your embedded app feels disconnected from the Shopify admin's design patterns.

Session token authentication is mandatory for embedded apps and replaces the older cookie-based authentication approach. If your app is still using cookies for session management in an embedded context, this will be flagged during review. Session tokens must be validated server-side on every authenticated request, and your frontend must refresh tokens appropriately before they expire. This is an area where many first-time submitters encounter rejections because the implementation looks correct in development but breaks under real-world conditions where token timing becomes relevant.

The Polaris design system is not strictly required for all app UI, but using it — or at minimum aligning with its visual principles — signals to reviewers that your app has been built with Shopify's ecosystem in mind. Jarring visual inconsistencies between your app's interface and the Shopify admin create a poor merchant experience, and reviewer feedback increasingly reflects this. Even if your app is primarily a backend tool, the configuration screens and dashboards that merchants interact with should feel considered and consistent with the environment they are working in.

Preparing Your App Listing Copy Before You Submit

The written content of your app listing is reviewed just as carefully as the technical implementation, and many developers underestimate how much time it deserves. Your app's title, tagline, and description are the first things a reviewer reads, and they are also what merchants search for. Your description must be specific, accurate, and free of claims your app cannot substantiate. Phrases like "the best", "the only", or "guaranteed results" are discouraged and may trigger additional scrutiny. Describe what your app does and how it works, not just what outcomes merchants hope to achieve.

Feature lists within your listing should correspond exactly to features that are implemented and working in the version you are submitting. If a feature is on your roadmap but not yet built, do not include it in the listing. Reviewers will test against your listed features, and a feature that appears in the description but doesn't function in the app is a direct rejection reason. Keep a private internal document tracking which features are live versus planned, and review your listing against it carefully before every submission and resubmission.

Help documentation linked from your listing should be complete, accurate, and genuinely useful at the time of submission. A help centre that contains placeholder articles or articles describing features differently from how they actually work will undermine your listing review. Write your documentation from the perspective of a merchant who has never used your app, and cover installation, configuration, common use cases, and troubleshooting. Reviewers use your help documentation to understand your app's intended behaviour, so clear documentation can actually assist the review process rather than just being a checkbox requirement.

What Happens After Approval: Staying Compliant Long Term

Passing your initial review is a milestone, but it is not the end of your compliance responsibilities. Shopify re-reviews apps when significant changes are made, and merchants can flag apps that behave problematically — which can trigger an unscheduled review. Maintaining a habit of reviewing the Shopify Partner changelog and API release notes ensures you are aware of upcoming deprecations or new requirements before they become urgent. API versions are deprecated on a rolling schedule, and apps still calling deprecated endpoints will eventually fail and may be delisted.

Merchant reviews and ratings in the App Store are visible to Shopify's trust and quality teams, and a pattern of negative reviews citing the same issues will attract attention. Respond to negative reviews professionally, address reported bugs promptly, and release updates through a structured process that includes testing on development stores before pushing to production. Shopify expects apps to improve over time, and an app that has not been updated in a long period may be flagged for a quality review to confirm it still meets current standards.

Content generation for your app's listing, blog presence, and help documentation is an ongoing task that compounds in value over time. Keeping your listing copy fresh, your blog content informative, and your documentation current all contribute to merchant trust and organic App Store visibility. Tools like BlogFlow can help you maintain a consistent content presence for your app without the overhead of producing everything from scratch — a practical advantage when you are also managing active development and merchant support simultaneously.

Try BlogFlow free at saltai.app — no credit card required.