Shopify App Store Submission: What Reviewers Actually Check

Getting your Shopify app rejected is a painful experience, especially when the feedback feels vague. You have spent weeks building something genuinely useful, your staging environment is clean, and your listing looks professional — yet the review team sends it back with a checklist of issues you never anticipated. For independent developers and merchant-side teams alike, that rejection email can feel like hitting a wall without a map.

The App Store review process is more rigorous than most people expect, and Shopify has tightened its standards significantly over the past two years. Reviewers are not simply checking whether your app installs without crashing. They are auditing your permissions, your billing logic, your privacy disclosures, your onboarding flow, and the accuracy of every claim you make in your listing. Each of those areas is a potential rejection point, and each one has specific requirements you need to understand before you submit.

This post breaks down exactly what Shopify reviewers look for during the submission process. Whether you are a merchant building a custom app for your own store, a developer submitting a public app, or a team bringing an internal tool to market, these sections will help you understand the criteria, fix common issues before submission, and move through review faster. The guidance here is grounded in the real patterns that cause delays and rejections across the Shopify partner community.

Understanding the Scope of Shopify's Review Criteria

Most developers assume the review is primarily a technical audit, but Shopify's App Store review covers four distinct dimensions: functionality, security, listing accuracy, and merchant experience. Each dimension is weighted, and a failure in any one of them can block your submission regardless of how strong the others are. Understanding this scope is the first step toward a successful submission.

On the functionality side, reviewers will install your app on a development store and test every core feature described in your listing. If your app claims to automate order tagging based on product type, a reviewer will create test orders and verify that the tagging behaves exactly as described. Discrepancies between claimed behaviour and actual behaviour are among the most common reasons for rejection, and they are entirely preventable with thorough pre-submission QA testing.

The security dimension covers data handling, API scope requests, and how your app manages sensitive merchant information. Shopify uses a principle of least privilege approach, meaning you should only request the API scopes your app genuinely needs to function. Requesting write access to customer data when your app only reads order totals is a red flag that reviewers will flag immediately. Document your scope usage internally before submission so you can justify every permission you have requested.

API Permissions and Scope Justification

API scope justification is one of the most scrutinised areas in the review process. Shopify's review team will cross-reference every scope you have requested against the features you describe in your listing and demonstrate in your app. If you request the write_customers scope but your app does not visibly modify customer records in any tested workflow, expect a rejection with a request for clarification or scope reduction.

The practical approach here is to audit your scope list before you submit and map each permission to a specific user-facing feature. For example, if you need read_orders and write_orders, document which workflows trigger each operation and ensure those workflows are clearly visible during the review walkthrough. Many developers include a simple internal spreadsheet that maps scope to feature to user action — this takes thirty minutes to create and saves days of back-and-forth with the review team.

OAuth implementation is another area where rejections happen frequently. Your app must handle the OAuth flow correctly, including state parameter validation to prevent CSRF attacks, and must not store access tokens in insecure locations. Reviewers test for these vulnerabilities specifically because they are high-risk issues that affect merchant security at scale. Running your OAuth flow through a security checklist before submission — not just a functionality test — will catch problems that automated testing often misses.

Billing Implementation and Shopify Payments Compliance

Shopify's billing API is mandatory for any app that charges merchants through the App Store. You cannot direct merchants to an external payment processor for subscription fees or one-time charges; all billing must flow through Shopify's own billing system. This is a hard requirement, not a preference, and apps that route billing outside the platform are rejected without exception.

The billing implementation must also match your listing pricing exactly. If your listing describes a $29 per month Professional plan with a 14-day free trial, your billing API call must create a subscription with exactly those parameters. Mismatches between listed pricing and billing API parameters are caught during review because reviewers check both your listing and your code. Build your billing logic against your finalised pricing structure before you submit, not as an afterthought after the listing is approved.

Usage-based billing requires particular care. If your app charges per order processed or per SMS sent, you need to implement usage charges through the appropriate billing API endpoints and clearly disclose the pricing model in your listing. Reviewers will simulate usage scenarios to verify that charges accumulate correctly and that merchants receive transparent reporting within the app itself. Apps that obscure or miscalculate usage charges are rejected and flagged for additional scrutiny on resubmission.

App Listing Accuracy and Marketing Claims

Your App Store listing is a contractual document as far as Shopify reviewers are concerned. Every claim you make in your description, every feature you list in your bullet points, and every screenshot you include must accurately reflect the app as it exists at the time of submission. Listings that describe planned features as current ones, or that use screenshots from a more polished version than the one being submitted, will be rejected.

Screenshots are a common problem area. Reviewers compare your screenshots against the actual app interface during testing, and inconsistencies — different UI colours, missing buttons, or workflows that do not match — are flagged as inaccuracies. Use your current production build to generate screenshots immediately before submission, and avoid using mockups or design assets that do not reflect the real interface. If your app has a dark mode or multiple themes, choose the most representative view and stay consistent.

Superlative claims in your listing copy are another rejection trigger. Phrases like "the fastest app on the Shopify App Store" or "guaranteed to increase your conversion rate" require substantiation that most developers cannot provide. Write your listing copy in factual, specific terms instead — describe what your app does, how it does it, and what outcomes merchants can realistically expect based on your own data. Specificity builds trust and avoids the vagueness that attracts reviewer scrutiny.

Onboarding Flow and Merchant Experience Standards

Merchant onboarding is tested during every review, and Shopify has clear expectations about what a good onboarding experience looks like. When a reviewer installs your app for the first time, they should be able to understand its purpose, complete initial setup, and reach a functional state within a few minutes without consulting external documentation. Apps that leave merchants on a blank screen or require complex configuration before anything works are penalised.

The onboarding flow should include contextual guidance — tooltips, placeholder text, or a brief setup wizard — that explains what each configuration option does. Reviewers are particularly attentive to empty states, which are the screens merchants see before they have any data in the app. An empty state should not be a blank white page; it should include a clear call to action and a brief explanation of what the merchant needs to do next. This is a UX standard that reviewers apply consistently across all categories.

Error handling is also evaluated during onboarding testing. If a merchant enters invalid input during setup, your app should return a clear, human-readable error message that explains what went wrong and how to fix it. Generic error codes or unhandled exceptions that expose stack traces are instant rejection points. Test every error path in your onboarding flow deliberately, not just the happy path, before you submit.

Privacy Policy, GDPR, and Data Disclosure Requirements

Privacy compliance is non-negotiable in the Shopify App Store. Every app must include a privacy policy URL in its listing, and that privacy policy must accurately describe what data the app collects, how it is stored, how long it is retained, and whether it is shared with third parties. Linking to a generic template privacy policy that does not mention Shopify, merchants, or customer data is insufficient and will be rejected.

GDPR compliance is evaluated specifically for apps that handle European merchant or customer data, which in practice means almost every app. Reviewers check whether your app provides mechanisms for data deletion requests and whether your privacy policy explains the legal basis for data processing. If you use third-party services like analytics platforms or email providers in your app's infrastructure, those relationships must be disclosed in your privacy policy as data sub-processors.

The GDPR webhooks that Shopify provides — covering customer data requests, customer data erasure, and shop data erasure — must be implemented in every public app without exception. These are not optional endpoints. Reviewers verify that your app has registered handlers for all three webhooks and that those handlers respond with a 200 status code within the required timeframe. Implement these endpoints early in development so they are not a last-minute addition that introduces bugs close to submission.

Conclusion

Shopify App Store review is a thorough process that covers permissions, billing, listing accuracy, onboarding, and privacy compliance in equal measure. The most common rejection causes are entirely preventable: mismatched API scopes, billing implementations that do not match listing pricing, inaccurate screenshots, and missing GDPR webhook handlers. Building a pre-submission checklist against these five areas will reduce your review cycle from weeks to days.

The merchants and developers who move through review fastest are the ones who treat the Shopify review criteria as a specification document rather than a hurdle. Read the requirements, test against them explicitly, and document your decisions so you can respond to reviewer questions quickly and confidently. A clean first submission is achievable with the right preparation.

Try SaltAI Agent for Shopify to streamline your app operations and merchant workflows with AI-powered automation. Try SaltAI Agent for Shopify free at saltai.app — no credit card required.