Shopify app development: the complete guide

A Shopify app is a web application that authenticates against a merchant's store and uses Shopify's APIs to read and change data, add surfaces to the admin or the storefront, or run logic at checkout. It is not a plugin that lives inside Shopify — it's your code, on your infrastructure, talking to Shopify over HTTPS.

That distinction drives everything else: you're building and hosting a web app, with all that implies.

This is the pillar for app-related articles on this site.

First: do you need one?

The honest starting question, because most app projects that fail were unnecessary. If a well-reviewed App Store listing does 90% of what you need, install it. Building custom to replace a subscription is almost never worth it on cost alone.

Custom is right when your process is a competitive advantage, when nothing in the store fits, when you're stacking three apps to fake one workflow, or when you need to talk to systems the ecosystem doesn't know about. Custom apps vs third-party apps is the full decision framework, and app development cost is what it runs to.

Custom or public

Custom apps are built for one store, installed directly, not listed publicly, not reviewed by Shopify. Most bespoke work is this. Faster to build, no review queue, no listing to maintain.

Public apps are distributed through the App Store, installable by any merchant, subject to Shopify's review and requirements. A product, not a project.

The difference is strategic rather than technical — the same code can be either — and it changes billing, review, support and roughly everything about the timeline. Private vs public apps covers choosing.

The stack

Shopify's recommended path is a Remix app scaffolded by the CLI, using Polaris for admin UI and their App Bridge library to embed in the admin. You do not have to use it — an app is just a web service, and plenty of production apps are Node, Rails, Laravel or Python — but the template handles OAuth, session storage, webhook registration and embedding correctly out of the box, and those are exactly the parts people get subtly wrong. The Remix app template covers what it gives you.

``bash npm init @shopify/app@latest ``

Authentication

Apps authenticate with OAuth. The merchant installs, approves the scopes you requested, and you receive a token you use for API calls on their behalf. Sessions in an embedded app use session tokens rather than cookies, because the app renders inside an iframe in the Shopify admin.

Get this wrong and the app either doesn't install or breaks intermittently in ways that are miserable to debug. App authentication and OAuth covers the flow and the traps — chiefly requesting more scopes than you need, which merchants notice and Shopify's review process asks about.

The APIs

• Admin API (GraphQL) — the main one. Products, orders, customers, inventory, fulfilment, metafields. The Admin API guide covers querying it and living within its rate limits.
• Storefront API — customer-facing data for headless storefronts.
• Customer Account API — authenticated customer data.
• Webhooks — Shopify telling you something happened. Webhooks covers verification, retries and idempotency, all of which matter more than they sound.

The REST Admin API still exists but GraphQL is where new capability lands. Build new work in GraphQL.

Extensions: where your app appears

An app is more useful when it shows up where the merchant or customer already is. Extensions are how:

• Admin UI extensions — blocks and actions inside Shopify's own admin pages. Admin UI extensions.
• Checkout UI extensions — components at defined points in checkout, on plans that support it.
• Shopify Functions — server-side logic for discounts, shipping, payment rules and cart validation. Functions.
• Theme app extensions — app blocks merchants place in their theme. Theme app extensions.

Together these replaced the old model of injecting code into themes and checkout, which is the change described in checkout extensibility.

Billing

Public apps charge through Shopify's Billing API so charges appear on the merchant's Shopify invoice. Custom apps for a single client are usually billed outside Shopify entirely. The Billing API covers subscriptions, usage charges and trials.

Distribution

Custom apps are installed via a link. Public apps go through review against Shopify's requirements — performance, security, privacy, mandatory webhooks, a listing that matches what the app does. Budget real time for it; first submissions are commonly rejected for things that are easy to fix and easy to miss. App Store listing requirements.

What people underestimate

• Rate limits. They shape your architecture, not your error handling.
• Webhook reliability. Delivery is at-least-once and occasionally not at all. You need reconciliation, not just handlers.
• Data privacy obligations. The mandatory GDPR webhooks are not optional and are checked in review.
• Ongoing maintenance. Shopify's API versions rotate. An app nobody maintains stops working — a real cost that belongs in the build-vs-buy decision.

An app is a web service that happens to talk to Shopify. Most of the difficulty isn't Shopify-specific — it's the ordinary discipline of running software other people depend on.