Shopify App Security: A Complete Guide to Protecting Your App, Merchants, and Customer Data

Introduction: Why Shopify App Security Can't Wait

A Shopify app doesn't just add features to a store. Depending on its scopes, it can read and change orders, customers, products, inventory, and storefront code. When a merchant installs your app, they're handing you that access and trusting you not to lose it.

If a vulnerability gets exploited, the damage rarely stays technical. Customer data gets exposed, storefronts get tampered with, and the fallout shows up as App Store rejection or delisting, churn, support load, and possible legal exposure.

October 2026 made this concrete for every app team. On October 15, Shopify released shopify app security check, a command in Shopify AI Toolkit and Shopify CLI that scans your app for Shopify-specific vulnerabilities such as unauthenticated routes, cross-shop data access, and unverified webhooks.

On October 20, following reported storefront hijacks involving third-party apps, Shopify published "Securing your app, together" and asked every app developer to act that same week. The asks included running the new security check, moving to expiring access tokens, protecting every account that touches the app with two-step authentication, removing access for people who no longer need it, and keeping the emergency developer contact current.

One week later, on October 27, Shopify followed up with firm dates. Public apps still on non-expiring offline access tokens get delisted on January 1, 2027, and their Admin API requests start failing on April 1, 2027. The same update shipped new tools: client credentials access, an IP allowlist, network access declarations, identity verification for development stores, and a new app security hub in the dev docs.

The takeaway for founders: security is no longer a box you tick before App Store submission. It's part of how you build, ship, and operate the app.

This guide covers Shopify's App Store security requirements, the vulnerabilities that show up most in Shopify apps, authentication and authorization, token management, webhook security, storefront security, data protection, infrastructure, and incident response. Whether you're shipping your first app or running a portfolio, use it as a framework for reviewing your security posture.

What Is Shopify App Security?

Shopify app security is the set of technical controls, development practices, infrastructure settings, and operating habits that protect your app, your merchants' stores, their customers' data, and your API credentials from misuse.

It covers:

• Authentication and authorization
• OAuth and access token management
• API access and permission scopes
• Webhook signature verification
• Merchant data isolation
• Customer data protection
• Storefront and theme extension security
• Infrastructure and network protection
• Secure development practices
• Vulnerability monitoring and incident response

It's not only about keeping attackers out. It's also making sure one merchant can never see another merchant's data, a teammate can't accidentally expose customer records, a webhook can't be forged, and a leaked credential stops working quickly.

Most public Shopify apps are multi-tenant: one codebase and one database serving hundreds or thousands of stores. That's what makes isolation so important. A weakness in a shared component can affect every merchant at once.

Why Shopify App Developers Need to Prioritize Security

Security is an engineering responsibility and a business requirement. Here are six reasons to put it near the top of your roadmap.

1. Protect merchant and customer data

Depending on its functionality and approved scopes, your app may handle:

• Customer names and contact details
• Shipping and billing addresses
• Orders and purchase history
• Product and inventory data
• Store configuration

Merchants are responsible for protecting that data, and you're the one holding it. Collect only what your app needs and restrict who and what can reach it.

2. Keep merchant trust

Merchants judge you on how you behave when something goes wrong. After a security incident, many will question whether to keep your app installed, even once the bug is fixed. Good security practice is how you earn the benefit of the doubt.

3. Pass App Store security review

Shopify reviews every app's security before listing it. The review checks protection against common web vulnerabilities, TLS, open network ports, token generation, and shortened URLs, plus iframe protection for embedded apps. Failing any of these delays or blocks approval.

Passing review doesn't mean your app is secure. Shopify describes these requirements as the minimum and asks developers to follow its broader security best practices too.

4. Prevent cross-shop data exposure

If your backend doesn't isolate records by store, a single bug can let one merchant read another merchant's data. Shopify calls out authentication and authorization mistakes as the cause of a large share of the security incidents it sees.

5. Protect your business

A serious incident means investigating systems, rotating credentials, revoking tokens, notifying merchants, handling support volume, possibly hiring outside specialists, and working through legal and contractual obligations. For a small app team, that can stall the roadmap for weeks.

6. Stay ahead of Shopify's changing requirements

Shopify's October 2026 updates set hard dates for expiring offline tokens and shipped new controls like the IP allowlist and network access declarations. The October 20 post also flagged tighter boundaries for storefront app code and higher App Store security requirements, with details to come. Teams that review their apps regularly absorb these changes without scrambling.

Shopify App Store Security Requirements: What Reviewers Check

Shopify's App Store security review checks five requirements, with iframe protection for embedded apps covered in its own guide.

Requirement	What you need to implement
Protection against common vulnerabilities	Defend against the OWASP Top 10 and other common web risks
TLS encryption	A valid HTTPS certificate from a trusted Certificate Authority
Closed network ports	No unnecessary services exposed publicly
Secure token generation	Randomly generated tokens with enough entropy, that expire and can't leak
Careful URL shortening	No predictable short URLs for confidential data
Iframe protection	Correct frame restrictions for embedded apps

1. Protect against common web vulnerabilities

Shopify expects every third-party app to be protected against common web vulnerabilities, including the OWASP Top 10: broken access control, cryptographic failures, injection, security misconfiguration, vulnerable and outdated components, and authentication failures. If reviewers find a vulnerability, the app is rejected until it's fixed.

2. Use a valid TLS certificate

All traffic between a merchant's browser and your app server must be encrypted with TLS, using a certificate from a trusted Certificate Authority. Self-signed certificates are not accepted, and if Shopify can't validate your certificate during review, the app is rejected. Let's Encrypt works fine. Monitor renewals so a certificate never lapses, and serve every endpoint over HTTPS.

3. Keep unnecessary ports closed

Expose only what your app needs. MySQL, Redis, Memcached, Elasticsearch, internal admin services, and staging environments should never be publicly reachable. Shopify scans for open ports with Nmap during review, and if it finds unexpected ones, you'll be asked to justify them.

4. Generate secure tokens

If your app authenticates users with tokens, they must be randomly generated with 128 bits of entropy. Shopify allows 64 bits in some cases where token length is a concern. Tokens must expire and must not be leakable or indexable by third parties.

One requirement that's easy to miss: any app URL that accepts a token must send a Referrer-Policy header set to origin-when-cross-origin or, preferably, no-referrer. Avoid predictable or sequential identifiers and reusable links that expose private merchant or customer information.

5. Shorten URLs with care

Short URLs are easy to enumerate. If your app generates short links for orders or customer details, an attacker can test values until they hit a valid one. Shopify asks for high-entropy, non-guessable URLs at all times, and no shortening at all for checkout URLs, order URLs, or anything carrying secret tokens or personal data.

These requirements are a baseline. Shopify's broader security documentation covers much more, and the rest of this guide walks through it.

8 Critical Security Areas Every Shopify App Developer Should Review

Shopify's security docs, now organized in its app security hub, group recommendations around the app server, storefront, credentials, infrastructure, and monitoring. Here's how to approach each area.

1. Authentication: verify every request before touching store data

Every request that reads or changes merchant data must be authenticated first, and the store must come from the result of that authentication, never from the request itself.

The most common mistake is trusting a shop value sent by the frontend, such as shop=example-store.myshopify.com. If the backend uses that value without verifying the request, an attacker can swap in another store's domain. Shopify explicitly warns against taking the store from a parameter, body field, header, or cookie.

Here's the part most teams miss. Your shipped JavaScript, including theme app extension assets and embedded app bundles, names every endpoint it calls, so every endpoint is discoverable. If one of them accepts the store from a shop parameter, any caller can act as any store that has your app installed. Expiring tokens and API log reviews won't catch this, because your own server makes the follow-up Admin API call with a valid token and the traffic looks normal.

Match the authentication method to where the request comes from:

Request source	Authenticate with
Embedded app in the Shopify admin	ID token
Storefront, including theme app extension JavaScript	App proxy signature
Checkout or customer account UI extension	The extension's session token
Shopify webhook	HMAC signature

If a request has no valid token or signature, reject it before doing anything else. Don't fall back to a shop value from the request.

A few details worth getting right:

• An app proxy signature proves which store a request came through, not who sent it. Don't let app proxy routes change store settings. For actions on behalf of a logged-in customer, use the logged_in_customer_id value from the signed request.
• If you validate ID tokens yourself, check every part: signature, expiry, audience, and destination claims.
• Validate shop domains against a pattern anchored at both ends, so a value like example.myshopify.com.attacker.net doesn't match.
• Debug, test, migration, and legacy routes need the same authentication. If you don't need a route, remove it.

Shopify's official app templates and libraries handle most of this for you, and Shopify notes that hand-rolled authentication is where things most often go wrong. Using a library still doesn't replace reviewing your own authorization logic.

Takeaway: authenticate every request, and never let a client-supplied shop value decide which merchant's data your backend touches.

2. Authorization and multi-tenant data isolation

Authentication answers "who is making this request?" Authorization answers "what is this request allowed to touch?" You need both.

Say your app stores merchant settings like this:

Record ID	Shop domain	Configuration
101	store-a.myshopify.com	Settings A
102	store-b.myshopify.com	Settings B
103	store-c.myshopify.com	Settings C

If a query fetches settings by record ID alone, anyone who can change that ID can read another store's data. That's an Insecure Direct Object Reference (IDOR). Scope every query to the authenticated shop as well as the requested record:

SELECT *
FROM shop_settings
WHERE shop_id = :authenticated_shop_id
  AND id = :requested_record_id;

The key is that authenticated_shop_id comes from verified authentication, not from user input. Shopify's guidance boils this down to three steps: authenticate the request, derive the shop from that authenticated identity, and confirm the requested resource belongs to that shop. The same applies to IDs inside requests, including customer IDs, order IDs, and GraphQL global IDs.

Apply it everywhere: orders, customers, product configurations, subscriptions, preferences, uploaded files, internal resources, and partner or billing records. Hiding another merchant's records in the UI is not access control. The backend has to enforce it on every request.

Takeaway: every query on merchant-owned data should be scoped to the authenticated shop.

3. OAuth, access tokens, and credential management

Shopify supports several ways to get access tokens: token exchange for embedded apps, the authorization code grant for standalone apps, and, as of October 2026, client credentials access for public apps. Whichever you use, the token you get is a key to the merchant's store within its scopes. If it leaks, someone else can use it.

Keep client secrets on the server. Never ship them in frontend JavaScript, browser bundles, public repos, or theme assets.

Store access tokens securely. Use proper secret management and encryption, restrict database access, and keep tokens out of logs.

Migrate to expiring offline access tokens now. Expiring offline tokens are already required for public apps created on or after April 1, 2026. For existing public apps, January 1, 2027 is the migration deadline. Here's the enforcement timeline Shopify published on October 27, 2026:

Date	What happens to public apps that haven't migrated
January 1, 2027	Delisted from the Shopify App Store and blocked from new installs. Existing installs keep working.
January 15, 2027	Merchants using the app see a warning in the Shopify admin.
April 1, 2027	Admin API requests using non-expiring offline access tokens return HTTP 403.

Shopify is clear that January 1 is the real deadline. The later dates exist to give merchants time to prepare, not to give developers extra runway. Custom apps, merchant-created apps, and online access tokens are not affected.

Expiring offline tokens last one hour and need a refresh flow. That matters most for background jobs, scheduled tasks, and webhook-triggered work. If your app loses a refresh token, the new client credentials access lets your backend request a fresh access token with a request signed by your app's private key, without waiting for the merchant to reopen your app. Follow Shopify's migration guide to update token acquisition, migrate existing installs, and validate storage and refresh handling.

Request only the scopes you need. If your app only reads products, it shouldn't ask for order or customer write access. Use optional scopes where they fit and drop permissions you no longer use.

Lock API access to your servers. Shopify now offers an IP allowlist in the Dev Dashboard. Add the IP addresses of your app servers so a stolen token can't be used from anywhere else.

Declare your network access. In the new [network_access] section of shopify.app.toml, list the servers your app's code loads from or sends requests to on a store. Shopify uses that list to spot requests your app didn't make.

Takeaway: treat the token migration as an active security project with a January 1 deadline, not as future maintenance.

4. Webhook security: verify every incoming event

Webhooks tell your app when orders are created, products change, inventory moves, customers update their details, the app is uninstalled, or data deletion is requested. They save you from constant polling, but the endpoint is public. Without verification, an attacker can send a forged event and get your app to act on it.

To secure webhooks:

1. Verify the HMAC signature.
2. Verify against the raw request body, before parsing.
3. Treat headers and payload, including the topic and shop domain, as untrusted until the signature checks out.
4. Reject anything with an invalid signature.
5. Make processing idempotent.
6. Use delivery identifiers to detect duplicates and replays.
7. Monitor failed deliveries.

Idempotency matters because Shopify retries deliveries when your endpoint doesn't respond successfully. If an order event sends a customer notification, a retry shouldn't send a second one.

Takeaway: never process a webhook just because it reached your endpoint. Verify it, and design handlers to survive retries.

5. Storefront and theme app extension security

Theme app extensions and app proxies put your code on the merchant's storefront, in front of their customers. If you render values from merchant settings, metafields, external services, or user input without escaping them, attackers can inject HTML or JavaScript. That's cross-site scripting (XSS), and on a storefront it can mean skimming, spam, or redirecting shoppers.

For example, if a widget drops a merchant's custom text field straight into the page as HTML, malicious content in that field runs in every visitor's browser.

Storefront practices to follow:

• Escape every value for the exact context you render it into.
• Render untrusted content as text whenever possible.
• If you genuinely need HTML, sanitize it with a strict allowlist of tags and attributes.
• Validate URLs and allowed schemes.
• Avoid unsafe HTML insertion methods.
• Don't assume metafields are safe just because they come from Shopify.
• Store app-owned storefront settings in protected namespaces.
• Never execute fetched runtime configuration as JavaScript.
• Don't serve merchant-written JavaScript or HTML directly to storefronts.

Shopify recommends theme app extensions over the deprecated ScriptTag approach. Extensions ship versioned assets with your app and give merchants better visibility and control. Also audit any custom CSS, JavaScript, or HTML you stored in the past rather than assuming it's clean.

Shopify serves a Content Security Policy on storefronts, but it describes this as a backstop, not a substitute for secure code.

Takeaway: treat every value you render on a storefront as untrusted until it's validated and correctly encoded.

6. Infrastructure and internal tool security

Your app server is only one part of the attack surface. Databases, background workers, support dashboards, staging environments, repos, cloud accounts, DNS, and CDN accounts can all be the way in.

Infrastructure checklist:

• Keep databases and queues private.
• Expose only the services you need.
• Use TLS for internal network traffic.
• Lock down internal dashboards.
• Separate production and staging.
• Apply firewall and network access rules.
• Keep secure backups.
• Review hosting and DNS permissions.
• Watch for unusual access.
• Keep dependencies and runtimes up to date.

Internal tools deserve extra attention. A support dashboard often shows data from every merchant. A stored XSS bug or weak login there gives an attacker access across your whole install base. Hold internal tools to the same standard as the public app.

Accounts matter as much as code. Shopify's October 20 post asked developers to turn on two-step authentication for their Partner account, hosting, CDN, code repositories, and email, and to remove access for anyone who no longer needs it.

Takeaway: support dashboards, migration scripts, internal APIs, and admin tools are inside your security perimeter.

7. Customer data protection and privacy compliance

If your app processes personal data, you're responsible for how it's collected, stored, accessed, retained, and deleted. Depending on where your merchants and their customers are, laws such as GDPR and the California Privacy Rights Act may apply.

Shopify also requires public App Store apps to handle three mandatory compliance webhooks:

Webhook	Purpose
customers/data_request	A request to access stored customer data
customers/redact	A request to delete customer data
shop/redact	A request to delete shop data

Your app must subscribe to these topics, verify their signatures, and respond to them, even if you don't think you store personal data.

Beyond the webhooks:

• Collect only what you need. An available scope isn't a reason to pull customer data. Shopify's guidance is to collect personal information only with express consent, and only the minimum required.
• Set retention periods for each category of merchant and customer data.
• Limit internal access. Not everyone on the team needs to see customer records.
• Delete properly. When a valid deletion request arrives, find every relevant record and remove it.
• Review third-party sharing. Know what you send to external providers, why, and under what controls.

Security and privacy overlap but aren't the same. Handling Shopify's compliance webhooks doesn't make you compliant with every privacy law that applies to you.

Takeaway: design data protection and deletion into your architecture before launch, not after.

8. Monitoring, vulnerability management, and incident response

An app that was secure at launch won't stay that way on its own. New features, dependency updates, and config changes all introduce risk. You need a standing process:

• Regular vulnerability scans
• Dependency monitoring
• Code review
• Admin API log reviews
• Access audits
• Infrastructure reviews
• Security testing before releases
• A written incident response plan

Shopify's app security check adds a Shopify-specific layer to that process. More on it below.

Common Shopify App Vulnerabilities and How to Prevent Them

These are the issues that show up most often in real Shopify app workflows.

Vulnerability	Potential impact	Prevention
Unauthenticated API endpoints	Unauthorized access or actions	Verify every request
Cross-shop data access	One merchant sees another's records	Scope queries to the authenticated shop
SQL injection	Unauthorized database reads or writes	Parameterized queries
Cross-site scripting (XSS)	Malicious scripts run in browsers	Context-aware escaping and sanitization
Forged webhooks	Fake events processed	Verify HMAC signatures
Credential leakage	Unauthorized API access	Keep secrets server-side, rotate on exposure
Server-side request forgery (SSRF)	Your server makes requests for an attacker	Restrict outbound destinations
Open redirects	Users sent to malicious sites	Allowlist redirect URLs
Weak session handling	Session abuse or replay	Validate session lifecycle
Over-requested scopes	Unnecessary access to merchant data	Least-privilege permissions

Why cross-shop data access is especially dangerous

Picture an app serving 500 merchants. Each one expects their data to stay private. If the backend fetches records by ID without checking which shop owns them, one crafted request can expose another merchant's data.

That's not an isolated bug. It's a tenant isolation failure that puts every merchant on the app at risk, and it damages trust with all of them at once. Test isolation across every merchant-facing resource and backend operation.

Shopify's App Security Check: How to Audit Your App

shopify app security check is the most useful addition to Shopify's security tooling this year. Released on October 15, 2026 as part of Shopify AI Toolkit and Shopify CLI, it runs locally and looks at your app's codebase, the configuration across your extension points, and your dependencies. Shopify made it open source.

Unlike a generic scanner, it looks for patterns specific to Shopify apps, including:

• Missing authentication or authorization checks
• Cross-shop data access
• Unverified webhook signatures
• Committed secrets
• Unsafe HTML rendering
• SQL injection
• Over-requested OAuth scopes
• Server-side request forgery
• Missing iframe protection
• Missing compliance webhooks

It works in two layers:

1. Deterministic scan. Fixed code inspections for questions with an exact answer, such as whether you're on an end-of-life API version or have a committed secret.
2. Agent review. Some issues need an understanding of your app's logic, like whether a query is really scoped to the authenticated shop. Your coding agent investigates those.

How to run it

Shopify recommends running it through a coding agent with Shopify AI Toolkit installed.

1. Open your app project. Go to the directory that contains your shopify.app.toml.
2. Install Shopify AI Toolkit for your coding agent, following Shopify's setup guide.
3. Run the check. Ask your agent: /shopify Check my app for security vulnerabilities
4. Review the findings. The agent records its findings with shopify app security record, and shopify app security review shows the combined results, most severe first. Each finding has a stable check ID, such as COMMITTED_SECRET, that maps to a page in Shopify's docs explaining the fix.
5. Fix what it finds. Start with high-severity issues: authentication, tenant isolation, exposed credentials, and unsafe storefront rendering.
6. Run it again. Repeat after fixes and on every release.

No coding agent? Run shopify app security check directly. You'll get the deterministic scan plus instructions you can hand to an agent later.

If your backend lives in another repo, point the check at it with --include-dir, for example shopify app security check --include-dir ../backend. Use --list-files to confirm exactly which files will be scanned.

What a clean scan doesn't tell you

A clean result doesn't mean your app is secure. Shopify describes the command as limited to your source code and one part of a layered approach. It doesn't test the running app, doesn't cover every best practice, can't assess your hosting setup, and doesn't replace API log reviews or incident response. It also only scans the directories you include.

If you have a separate backend, a shared library, or an internal support tool, include them in the scan. Use the check alongside dependency scanning, infrastructure reviews, and manual code review.

A Practical Shopify App Security Checklist

Use this to review your app end to end.

Authentication and authorization

• Authenticate every endpoint that reads or changes merchant data.
• Take the shop identity from verified authentication, never from the request.
• Validate ID tokens fully: signature, expiry, audience, destination.
• Validate shop domains with a pattern anchored at both ends.
• Verify app proxy signatures, and keep app proxy routes from changing store settings.
• Enforce authorization on every protected operation.
• Scope every database query to the authenticated shop.
• Authenticate or remove debug, test, migration, and legacy routes.

OAuth and credentials

• Keep client secrets and access tokens on the server.
• Keep credentials out of logs.
• Migrate to expiring offline access tokens before January 1, 2027.
• Implement token refresh, and set up client credentials access as a recovery path.
• Request only the scopes you need, and remove unused ones.
• Add your server IPs to the IP allowlist in the Dev Dashboard.
• Declare your app's network access in shopify.app.toml.

Webhooks

• Verify HMAC signatures against the raw request body.
• Reject invalid requests before parsing or acting on them.
• Make processing idempotent and detect duplicate deliveries.
• Subscribe to the three mandatory compliance webhooks.

Storefront and extensions

• Escape untrusted output for its context.
• Sanitize HTML with a strict allowlist when HTML is required.
• Validate URL schemes.
• Use theme app extensions instead of ScriptTag.
• Never execute fetched runtime configuration.
• Audit previously stored custom CSS, JavaScript, and HTML.
• Configure iframe protection for embedded apps.

Infrastructure and accounts

• Use valid TLS certificates and monitor renewals.
• Send a Referrer-Policy header on any URL that accepts a token.
• Keep databases and queues private, and close unnecessary ports.
• Secure staging environments and internal dashboards.
• Turn on two-step authentication for your Partner account, hosting, CDN, code repos, and email.
• Remove access for people who no longer need it.
• Keep dependencies and runtimes updated, and maintain secure backups.

Monitoring and incident response

• Run shopify app security check before submission and on every release.
• Include every codebase that touches merchant data.
• Review Admin API logs for unusual IPs and user agents.
• Write down an incident response process.
• Keep the emergency developer contact in the Partner Dashboard current.

What to Do If Your App Has a Security Incident

Even well-run apps get hit. What matters is having a clear response before you need it. If you suspect a compromise, don't start making uncoordinated changes before you understand what happened.

1. Contain it. Stop further damage: disable the affected endpoint, restrict access, revoke compromised credentials, or isolate the affected system.
2. Preserve evidence. Keep logs, request records, timestamps, and system state. You'll need them to work out which merchants were affected.
3. Notify Shopify immediately. Shopify asks developers to report suspected app security issues to partner-security-reports@shopify.com. Keep your emergency developer contact current so Shopify can reach someone who can act quickly.
4. Work out the scope. Which systems were affected? Were credentials exposed? Which stores are involved? Was customer data accessed? Were unauthorized changes made? How long was the issue exploitable?
5. Fix the root cause. Don't just patch the symptom. Find the underlying weakness and add controls so it can't happen again.
6. Notify affected merchants and meet your obligations. Shopify is explicit that you're accountable for fixing the problem and notifying affected merchants, with its support. Also check any contractual or legal notification requirements.
7. Document it. Write up the cause, impact, response, fix, and lessons learned, and feed them back into how you build.

A 30-Day Shopify App Security Plan

If you haven't done a full security review recently, you don't have to fix everything at once. With the token deadline on January 1, 2027, starting this month leaves enough room to test before it lands.

Week 1: Audit and find the risks

• Read Shopify's app security hub and note which practices apply to your app.
• Run shopify app security check, including any separate backend.
• Find every endpoint that trusts a request-supplied shop value.
• Check tenant isolation in your database queries.
• Look for exposed credentials.

Outcome: a prioritized list of findings.

Week 2: Fix the critical issues

• Close unauthenticated endpoints.
• Fix cross-shop data access.
• Verify webhook signatures.
• Remove and rotate exposed credentials.
• Fix unsafe storefront rendering.
• Address SQL injection and SSRF findings.
• Confirm iframe protection.

Outcome: critical weaknesses fixed and retested.

Week 3: Tokens, data, and infrastructure

• Start or finish the expiring token migration, and set up client credentials access.
• Review scopes and remove unused ones.
• Set up the IP allowlist and declare network access.
• Check database and network exposure.
• Review customer data retention and the mandatory compliance webhooks.
• Turn on two-step authentication across every critical account.

Outcome: stronger credential handling, privacy handling, and infrastructure.

Week 4: Make it routine

Build security into your release process, so every release goes through:

1. Automated tests.
2. Dependency and vulnerability scans.
3. shopify app security check.
4. A review of new endpoints, new scopes, and new storefront rendering.
5. A check of access controls and infrastructure changes.
6. Fixes for high-severity findings before deploy.

Automate as much of this as you can in CI/CD. Then:

• Review Admin API logs and set up dependency monitoring.
• Write down your incident response process.
• Review employee and contractor access.
• Confirm your emergency developer contact.
• Schedule a monthly review of API traffic, token activity, unusual auth attempts, dependency issues, account permissions, and open findings.

Outcome: a security process that keeps running after the initial audit.

Frequently Asked Questions About Shopify App Security

What are the security requirements for Shopify apps?

Shopify's App Store review checks protection against common web vulnerabilities, valid TLS certificates, closed network ports, secure token generation, and careful handling of shortened URLs. Embedded apps also need iframe protection. Shopify treats these as the minimum and expects you to follow its broader best practices too.

How do I secure my Shopify app?

Authenticate every request, take the shop from verified authentication, scope every query to that shop, move to expiring offline tokens, verify webhook signatures, escape storefront output, and lock down your infrastructure and accounts. Run shopify app security check on every release and review your Admin API logs.

What is Shopify's app security check?

It's a command in Shopify AI Toolkit and Shopify CLI, released in October 2026, that scans your app for Shopify-specific vulnerabilities. It combines a deterministic scan with an agent review for issues that depend on your app's logic. Run shopify app security check, or ask an agent with AI Toolkit installed: /shopify Check my app for security vulnerabilities.

What is cross-shop data access?

It's when one merchant can reach another merchant's data through a bug in your app, usually because a query isn't scoped to the authenticated shop or because the backend trusts a shop value from the request. Prevent it by enforcing tenant isolation on every merchant-owned resource.

What is the deadline for expiring offline access tokens?

January 1, 2027. Public apps still on non-expiring offline tokens are delisted and blocked from new installs that day, merchants see warnings in their admin from January 15, and Admin API requests with those tokens return HTTP 403 from April 1, 2027. Apps created on or after April 1, 2026 were already required to use expiring tokens. Custom apps, merchant-created apps, and online tokens aren't affected.

Do expiring tokens make my app secure?

They limit how long a leaked token is useful, which is valuable. But they don't fix authentication bugs. If an endpoint trusts a shop value from the request, your server will still make a valid, token-authenticated API call on the attacker's behalf, and it will look like normal traffic.

How do I verify Shopify webhook requests?

Verify the HMAC signature against the raw request body using your app's secret, before you parse anything. Treat headers like the topic and shop domain as untrusted until the signature verifies. Reject invalid requests, and make your handlers idempotent so retries don't cause duplicate actions.

Does Shopify secure my app for me?

No. Shopify provides libraries, platform protections, docs, and scanning tools. You're still responsible for your app's logic, data isolation, infrastructure, internal tools, monitoring, and incident response.

What's the difference between authentication and authorization?

Authentication confirms who is making a request. Authorization decides what that identity can access or change. Shopify apps need both.

Do Shopify apps need to comply with GDPR?

If your app processes personal data, GDPR and other privacy laws may apply depending on whose data it is. Separately, Shopify requires public apps to handle the customers/data_request, customers/redact, and shop/redact compliance webhooks.

How often should I run security checks?

Before App Store submission and on every release. Add continuous dependency scanning, infrastructure reviews, API log monitoring, and periodic audits on top.

What should I do if my app has a vulnerability?

Contain it, preserve evidence, report it to partner-security-reports@shopify.com, work out the scope, fix the root cause, and notify affected merchants. Check your legal and contractual obligations too.

Can AI-generated code introduce vulnerabilities?

Yes. AI-generated code can get authentication, query scoping, rendering, or webhook handling wrong just like hand-written code. Review it to the same standard and run the security check before you deploy.

Final Thoughts

A successful app is one merchants can trust with their business, not just one with good features. Security isn't something you do once for App Store review or after an incident. It belongs in how you build features, handle credentials, process data, ship releases, and run infrastructure.

Shopify's October 2026 updates put a date on it. If your app still uses non-expiring offline tokens, has endpoints that trust a shop parameter, or hasn't been through the new security check, now is the time to fix that. You have until January 1, 2027 on tokens, and the rest shouldn't wait that long.

Start with Shopify's app security hub, run the check, fix the highest-risk findings first, and turn the review into a habit. Passing App Store review is the floor. The real bar is protecting merchant data and customer privacy every release.

Editorial disclaimer: This article is an educational guide, not a security audit or legal advice. Shopify's requirements, documentation, and applicable regulations change. Always check details against Shopify's current developer documentation and get qualified security or legal advice where appropriate. Last reviewed November 4, 2026.