Shopify SubmitWill your connector pass Shopify App Store review - and which choices can you never undo?

How it works - and what is sourced

The checks follow the skill's rules the review enforces, its distribution menu, its billing decision, its submission and timeline sections, Built for Shopify and keeping the listing, plus the skill's submission packet - which is where the three compliance webhooks (customer data request, customer redact, shop redact) come from. shopify.app.toml is read by a TOML parser written for app configs; every line it cannot read is named with its number and skipped. The scopes are sorted into a fixed set of kinds: orders and customers scopes are protected customer data Level 1; name, address, phone and email (Level 2) can never be read from a scope, so the interview's answer decides them.

The distribution menu starts from a public app with limited visibility for the pilot, flipped to fully visible after launch; launch-day discovery promotes fully visible at approval; a Plus organization that refuses Shopify billing, or a launch inside the 6 weeks review takes at its fastest (reported), promotes a custom app - which wins only on speed. When billing keeps every Shopify charge off Shopify the verdict is "closed to the App Store as planned", and the plan writes the compliant version under a stated assumption. The fixed TOML sets use_legacy_install_flow to false, sets embedded = true only when a plan says so, and never writes a scope, a URL or an id. A saved app keeps a snapshot of its checks, so reopening it shows what changed since you saved it; mark it resubmitted and the next fixes run carries the previous round's fixes with the plan.

Two labels, kept apart. Figures from shopify.dev carry a dagger: registration $19†; 0%† on the first $1M†, then 15%†; 15%† past a $20M† App Store year or $100M† company revenue; processing 2.9%†; names within 30 characters†; review requests at most once per 60 days† and 3 times a year†; 50 net installs† and 5 reviews†; LCP 2.5 s†, CLS 0.1†, INP 200 ms† over 100 calls in 28 days†; a suspension for three months†; quality checks within 7 days† and 30 days†; expiring offline access tokens† before 2027-01-01† and 403 errors from 2027-04-01†; requirement 4.2†. Forum and practitioner figures say so: plan 2-3 rounds and 6-14 weeks to Published (reported); about 30 days per review (reported); reported cooldowns run 2 weeks to a month; exemptions are rare (reported).

† from shopify.dev - Shopify changes requirements without notice; verify before relying on it. "reported" = forum or practitioner reports, not Shopify policy.