Shopify App Security Checklist: Verify Before Launch
A practical pre-launch Shopify app security checklist covering access scopes, token storage, webhook verification, PII handling, AI features and a final review.
Before you launch a Shopify app, you need to verify that it meets Shopify's security requirements. This Shopify app security requirements checklist covers the essentials: access scopes, token storage, webhook verification, PII handling, AI features, and a final pre-launch review. Use it to avoid rejections, data breaches, and merchant trust issues.
Why Shopify app security is now a launch blocker
Shopify reviews apps for security and compliance before listing them in the App Store. Even private apps used by a single merchant must protect customer data. A security failure can lead to app removal, legal liability, and damaged reputation. Merchants and agencies building custom apps should treat security as a launch gate, not an afterthought.
Access scopes and least-privilege: what to request and what to drop
Request only the access scopes your app needs. Over-requesting scopes increases risk and can cause merchants to distrust your app. Review each scope and justify its use.
How to apply least-privilege
- List every feature your app provides.
- Map each feature to the minimum scopes required.
- Remove any scope not directly used.
- Use optional scopes only when the merchant enables a feature.
- Document why each scope is needed in your app listing.
Common scopes and when to use them:
| Scope | When to request |
|---|---|
read_products |
Displaying product info |
write_products |
Editing products |
read_orders |
Accessing order data |
write_orders |
Modifying orders |
read_customers |
Viewing customer details |
write_customers |
Updating customer records |
Drop scopes like write_themes or read_all_orders unless absolutely necessary. For apps that sync data to Zoho CRM, request only the scopes needed for the specific entities you sync.
Token storage, webhook verification and HMAC checks
Access tokens are sensitive. Store them securely and verify all incoming requests.
Token storage
- Never store tokens in client-side code or public repositories.
- Use server-side storage with encryption at rest (e.g., AWS Secrets Manager, environment variables).
- Rotate tokens regularly and revoke them when no longer needed.
- For apps using Zoho, our Zoho Middleware handles OAuth token refresh securely.
Webhook verification
- Verify the HMAC signature of every webhook request using your app's shared secret.
- Reject requests with invalid signatures.
- Use HTTPS endpoints only.
- Implement idempotency to handle duplicate webhooks.
HMAC checks for proxy requests
- If your app uses app proxies, verify the HMAC signature on every request.
- Validate the shop domain and timestamp to prevent replay attacks.
Handling customer and order data: logging, retention and PII
Customer data is regulated. Handle it responsibly.
Logging
- Avoid logging PII (names, emails, addresses) in plaintext.
- Use structured logging with redaction for sensitive fields.
- Set log retention periods and purge old logs.
Retention
- Store only data necessary for app functionality.
- Delete data when a merchant uninstalls your app (Shopify requires this via mandatory webhooks).
- Provide a data deletion request endpoint.
PII
- Encrypt PII at rest and in transit.
- Limit access to PII to authorized personnel only.
- Anonymize data for analytics or testing.
AI features in your app: prompt data, third-party models and consent
If your app uses AI, you must handle data sent to AI models carefully.
- Disclose in your privacy policy that data may be sent to third-party AI providers.
- Obtain merchant consent before sending customer data to AI models.
- Avoid sending PII to AI models unless necessary and consented.
- Use models with data processing agreements (e.g., OpenAI, Anthropic, Google).
- Implement logging of AI interactions for audit purposes.
- Allow merchants to opt out of AI features.
For AI agents that access CRM or store data, ensure they follow the same least-privilege and consent rules. Our AI Chat & AI Agents service builds with these safeguards.
Pre-launch security review checklist (copy this)
Use this checklist before submitting your app to the Shopify App Store or deploying to production.
- Access scopes: only necessary scopes requested; documented justification.
- Token storage: tokens stored server-side, encrypted, rotated.
- Webhook verification: HMAC validated for all webhooks.
- HMAC checks: app proxy requests validated.
- HTTPS: all endpoints use HTTPS.
- Logging: PII redacted; retention policy set.
- Data retention: deletion on uninstall implemented.
- PII: encrypted at rest and in transit; access restricted.
- AI features: consent obtained; data processing agreements in place.
- Privacy policy: discloses data handling and AI use.
- Penetration testing: completed and issues resolved.
- Dependency scanning: no known vulnerabilities.
- Error handling: no sensitive data in error messages.
- Rate limiting: implemented to prevent abuse.
For custom Shopify app development that follows these requirements, see our Shopify app development services.
Final thoughts
Security is not a one-time task. Review this checklist regularly and stay updated on Shopify's requirements. A secure app protects your merchants, their customers, and your reputation.
Related reading
Frequently asked questions
What are the mandatory security requirements for a Shopify app?
Shopify requires apps to use OAuth for authentication, request only necessary access scopes, verify webhook HMAC signatures, store tokens securely, and handle customer data according to privacy laws. Apps must also implement mandatory webhooks for data deletion and comply with Shopify's API terms.
How do I verify webhook HMAC in Shopify?
Compute the HMAC-SHA256 digest of the raw request body using your app's shared secret, then compare it to the X-Shopify-Hmac-Sha256 header. Use a constant-time comparison function to prevent timing attacks. Reject requests with invalid signatures.
What data should I avoid logging in a Shopify app?
Avoid logging any personally identifiable information (PII) such as customer names, emails, addresses, and phone numbers. Also avoid logging access tokens, API keys, and full request bodies that may contain sensitive data. Redact or hash sensitive fields before logging.
Do I need consent to use AI features in my Shopify app?
Yes. If your app sends customer data to third-party AI models, you must obtain merchant consent and disclose this in your privacy policy. Ensure the AI provider has a data processing agreement and avoid sending PII unless necessary and consented.
How often should I review my Shopify app's security?
Review security at least quarterly and after any major change. Also monitor Shopify's developer changelog for updates to security requirements. Regular penetration testing and dependency scanning help maintain a strong security posture.
Need help securing your Shopify app?
Our team can review your app against this checklist and implement the necessary safeguards. Get in touch to discuss your project.