Shopify
HardA custom-distribution app on a development store works within an hour, but a public app that any merchant can install needs App Store review, and there's no unlisted public option (unpublished apps were removed in 2019).
Agent-researched, not yet reviewed by a personResearched 2026-10-20
Working in dev
30 min–2 hours
Signing in with your own account
Any user can connect
2–6 weeks
A public App Store app that reads orders and customer PII (protected customer data Level 2); custom distribution to a single store or one Plus organization skips review and works the same day. Shopify publishes no review SLA; during 2026 backlogs reviews ran 30+ days, and each 'Paused' fix round adds more.
- Waiting on
- Protected customer data access request approval, then App Store review (submitted, possibly paused for fixes, then published). Shopify publishes no SLA.
- Cost
- One-time $19 USD App Store registration fee (waived for accounts created before 2021-08-01 or partners who only build custom apps). App charges have to go through Shopify Billing, with Shopify's revenue share.
What you need first
A Shopify Partner / Dev Dashboard account and a development store
Apps are created and client credentials live in the Dev Dashboard. Testing happens on development stores, which don't need review.
A distribution choice made up front (public or custom)
You must select a distribution method before requesting protected data access, and Shopify says you can't change it after you select it.
An HTTPS app URL and redirect URI that exactly match the app configuration
redirect_uri has to exactly match a URI configured in the Dev Dashboard or in the [auth] section of shopify.app.toml.
A GraphQL Admin API integration (not REST)
Since 2025-04-01, new public apps have to be built exclusively with the GraphQL Admin API.
Privacy policy, data-protection practices, and a screencast with test credentials
The App Store checklist asks for a complete English screencast of setup and functionality, and test credentials for any third-party platform. Protected customer data Level 2 adds encryption, access logging, and incident response policy requirements.