OAuth Readiness
Back to all apps

Shopify

Generated live by the research agent (Gemini), checked 2026-10-19. Setup not tested by hand.

Shopify requires all public apps connecting to merchant stores to undergo an App Store review before they can be published and accessed by external merchants. Developers configure apps via the Shopify CLI or Partner Dashboard and must comply with platform requirements, billing rules, and scope restrictions.

Tier 3: Review required

Hands-on work
10–35 hours
Waiting for approval
Unknown
Confidence
high

Assumes: A public multi-tenant application that external merchants install via OAuth to grant an AI agent read and write access to store resources such as orders, products, and fulfillment data.

10 min1 hour1 workday1 week1 month6 months

Solid dark bar: your hands-on work. Amber: the minimum wait. Hatched: the range sources disagree on, or an open-ended wait.[2][4][6]

Biggest blocker: Failing core App Store review standards, encountering fatal installation or OAuth redirect errors, or repeatedly failing reviewer issues, which triggers a submission suspension.[2][5][6]

Recurring: Maintaining compliance with updated Shopify App Store requirements, API versions, and Partner Program terms.[2][3][5] Handling merchant charge history, subscription state tracking, and rate limits.[3][8]

Why tier 3? Set by: provider review.
The tier is computed from these seven facts by a fixed rule, not chosen by the AI. High: the gates that set this tier are backed by the provider's own docs or our own test.
Self-serve credentialsYesDevelopers can self-serve credentials by creating an app project and configuring app identifiers and OAuth redirect URLs in the Partner Dashboard or shopify.app.toml file.[2][7]
Limits until reviewedYesDraft applications are tested on development stores within a Partner organization, and app configurations do not take effect for all production stores until deployed and published.[2][4][7]
Provider reviewYesAll public apps (whether fully visible or limited visibility) must complete the app review process and be approved before external merchants can install them in production.[2][4]
Security assessmentNoNot mentioned in the official process: Shopify uses an internal app review team, code requirement checks, and protected customer data access approval rather than requiring an external third-party security assessment.[2][4][5][6]
Business verificationNoNot mentioned in the official process: developers must provide contact details, an emergency technical contact, and agree to the Partner Program Agreement, but formal third-party business verification is not described.[2][5][6]
Mandatory feesNoNot mentioned in the official process: no app submission fees or Partner account fees are listed in the review requirements.[2][4][5][6]
Partner or paid accessNoNot mentioned in the official process: standard public app creation is open to registered Partners, though individual sensitive scopes require dedicated Shopify approval.[1][2][4]

Composio has no managed app here (shopify), so you need your own OAuth app before users can connect at all. Start the slow steps first. Managed auth list

If your case is different

Approval-required sensitive scopes
Specific authenticated scopes, such as read_all_orders (beyond the 60-day default window), read_apps, read_marketplace_fulfillment_orders, or write_checkout_settings, require separate approval from Shopify before you can declare them.
Protected customer data access
If an app reads customer data, the developer must meet specific protected customer data requirements and apply for access via the Partner Dashboard prior to submitting the app for review.
Custom internal apps
Shopify supports custom apps configured for a single merchant store, which do not go through App Store review but are restricted from public distribution.

Steps

Agent steps an AI agent can do or draft for you. You steps that need your identity, accounts, legal authority or a real demo.

  1. Agree to partner terms and configure app project

    You

    Create a Partner account, agree to the Partner Program Agreement and API License terms, and initialize the app project with the Shopify CLI or Partner Dashboard.[2][5][7]

  2. Configure OAuth redirect URLs and scopes

    Agent

    Define client IDs, application URLs, allowed OAuth redirect URLs, and required access scopes in the shopify.app.toml file.[2][7]

  3. Implement session token authentication and compliance webhooks

    Agent

    Implement session tokens for authentication and subscribe to required compliance webhooks.[5][6]

  4. Integrate Shopify App Pricing or billing system

    Agent

    Configure pricing plans in the Partner Dashboard and implement checks against activeSubscription in the Partner API if charging merchants.[2][5][8]

  5. Apply for protected customer data access if needed

    You

    Submit an application in the Partner Dashboard for protected customer data access prior to requesting app review.[2][6]

  6. Test app on a development store and run AI self-review

    Agent

    Install and test the OAuth install flow on a development store and execute the Shopify AI Toolkit self-review command (/shopify-app-store-review) to catch codebase issues.[2][4]

  7. Provide submission metadata and emergency contact

    You

    Enter listing details, an API contact email, and an emergency phone number and email in the Shopify App Store review setup.[6]

  8. Run automated pre-submission checks

    Agent

    Execute the mandatory automated checks on the App Store review page in the dashboard to ensure all basic criteria pass.[6]

  9. Submit app for review and await feedback

    YouWait

    Submit the app for review and respond to any reviewer feedback or fix requests sent to the submission contact email.[4][6]

What you will need

  • App URL and allowed redirect URLs must redirect merchants directly to the OAuth screen without fatal errors.[2]
  • Apps charging merchants must use Shopify App Pricing or the Shopify Billing API.[2][5][8]
  • Developers must subscribe to required compliance webhooks.[6]
  • An emergency technical contact (email and phone number) must be provided.[6]
  • Apps must comply with the Partner Program Agreement and Acceptable Use Policy.[2][5]

Nuances that catch people out

  • Applying for protected customer data is not permitted while an app is actively under review; it must be requested beforehand.[6]
  • Using the words 'Shopify' or 'Example' (or misspelled variants) in application domains or API contact emails violates platform policies.[6]
  • Failing to address issues highlighted by the reviewer after multiple exchanges can result in a temporary submission suspension.[6]
  • Any scope that grants write access automatically includes read access, so write scopes should not be requested redundantly.[1]

If you get stuck or rejected

App fails review because it does not redirect immediately to the OAuth grant screen upon install.
Verify that your app URL and allowed redirection URLs are properly configured and handle incoming install requests by redirecting merchants to OAuth, or switch to Shopify managed installation.[2]
App status moves to Paused or Reviewed due to unaddressed bugs or missing test instructions.
Review the email from Shopify outlining the required changes, fix the errors, ensure test instructions are valid, and click Submit fixes in the status banner.[2][4]
Partner API requests return rate limit errors ({'errors': [{'message': 'Too many requests'}]}).
Throttle requests to remain within the limit of four requests per second per Partner API client.[3]

Evidence

What we could not verify

  • Specific calendar turnaround time (wait days) for Shopify App Review approval, as the provided sources do not specify exact review turnaround durations.
  • Whether there is any monetary fee for joining the Shopify Partner program itself (though no submission fee is mentioned in the review materials).

Sources

Each quote was checked by code against the live page. “Not found on page” means the quote may be paraphrased, so treat that claim with care.

  1. Shopify API access scopes
    Provider docsQuote found on pagechecked 2026-10-19
    Shopify restricts access to scopes for apps that don't have a legitimate use for the associated data.
  2. Pass app review
    Provider docsQuote found on pagechecked 2026-10-19
    The app review team will only review production-ready apps.
  3. Partner API reference
    Provider docsQuote found on pagechecked 2026-10-19
    The Partner API has a rate limit of four requests per second per Partner API client.
  4. About the app review process
    Provider docsQuote found on pagechecked 2026-10-19
    Shopify's app requirements are the same for both fully visible and limited visibility public apps.
  5. App Store requirements
    Provider docsQuote found on pagechecked 2026-10-19
    The Shopify App Review team can reject an app at their discretion if it doesn't meet the set standards.
  6. Submit your app for review
    Provider docsQuote found on pagechecked 2026-10-19
    Applying for protected customer data isn't possible while the app is under review.
  7. App configuration
    Provider docsQuote found on pagechecked 2026-10-19
    For app configuration changes to take effect for all stores in production, you need to run the deploy command .
  8. Shopify App Pricing
    Provider docsQuote found on pagechecked 2026-10-19
    Shopify App Pricing is the default option when you submit a new public app for approval.