Shopify App Security Checklist for Developers (2026)
A Shopify app security checklist covering HMAC verification, session tokens, protected customer data, GDPR webhooks, and what app review rejects.
A Shopify app security checklist covering HMAC verification, session tokens, protected customer data, GDPR webhooks, and what app review rejects.
How to test Shopify apps end to end: development stores, billing test charges, CLI webhook triggers, Playwright in the embedded admin, and CI pipelines.
Anatomy of the Shopify Remix app template: shopify.app.toml, session token auth, Prisma session storage, webhooks, and fixes for the common gotchas.
Shopify webhooks are at-least-once, unordered, and removed after repeated failures. Build HMAC checks, dedupe, and reconciliation that survive it.
React to Shopify catalog changes as they happen: subscribe to product and inventory webhooks, verify the HMAC, stay idempotent, and keep a feed in sync.