# Shopify Submit

> Get a SaaS connector through Shopify App Store review. Paste your shopify.app.toml, how you bill Shopify merchants and
> your listing text, and get distribution, billing, install flow, protected customer data and listing rules checked
> against Shopify App Store review, then the submission plan or the fixes for a paused review.
> Built on the SkillSafe skill @samber/shopify-app-store-playbook, from samber/developer-platform-skills (MIT), by
> Samuel Berthe.
> Not affiliated with or endorsed by Shopify.
> Scope: a B2B SaaS vendor taking its own Shopify app through App Store review and keeping it listed - public vs custom
> distribution, Shopify billing for an already-billing SaaS, protected customer data, the submission packet, review
> rounds and Paused cooldowns, Built for Shopify, review requests and quality checks. Not generic listing copy, not your
> own marketplace's review, not a custom app for one client store, not Theme Store themes, not merchant setup, not app code.

https://shopify-submit.skillsafe.ai/

## What is free
- Parsing: shopify.app.toml by a TOML parser written for app configs - key = value with strings, true or false, numbers and lists of strings, [tables], [[array tables]], dotted keys and # comments - every line it cannot read named with its number and skipped: client_id, name, handle, application_url, embedded, [access_scopes] scopes, optional_scopes and use_legacy_install_flow, [auth] redirect_urls, [webhooks] api_version, [[webhooks.subscriptions]] topics, uri and compliance_topics (and the older [webhooks.privacy_compliance] URLs), [app_proxy], [pos] embedded and [build].
- The scopes, each with a kind from a fixed set: protected (read_orders, write_orders, read_all_orders, read_customers, write_customers - protected customer data Level 1), script_tags, pixel, checkout and standard; optional scopes marked. Name, address, phone and email (Level 2) cannot be read from a scope: the interview's data answer decides Level 2.
- The listing, from name:, subtitle: and pricing: lines with everything else read as the description, linted for pricing outside Pricing details ("billed separately", a price, a monthly charge, a pricing page), stats, superlatives (#1, best, first, only) and testimonials, and keyword stuffing in the card subtitle.
- The checks, each with an id, the skill's rule and pass, fix, fail, note or n/a: billing_shopify, billing_existing, stripe_path, app_pricing_fit and listing_pricing (billing); distribution_choice and dev_app (distribution); install_surface, install_token_exchange and toml_legacy_install (install flow); toml_embedded, app_bridge, expiring_tokens and graphql_only (App Bridge, tokens and the API); protected_data, scope_level and review_note_scopes (protected customer data); compliance_customers_data_request, compliance_customers_redact, compliance_shop_redact, shopify_in_urls and toml_identity (the app configuration - the three compliance webhooks come from the skill's submission packet); name_platform, name_length, name_match, listing_subtitle and listing_claims (the listing); review_requests and reviewer_credentials; script_tags (storefront and category); bfs_installs, bfs_reviews and bfs_connector (Built for Shopify); stage_route and timeline_fit (your stage).
- The distribution menu: a public app with limited visibility for the pilot, then fully visible > fully visible at approval > a custom app per enterprise store, re-ranked by the interview - launch-day discovery promotes fully visible at approval; one Plus organization that refuses Shopify billing, or a launch inside the 6 weeks review takes at its fastest (reported), promotes the custom app - each naming the answer that moved it. When billing keeps every Shopify charge off Shopify, the verdict is "closed to the App Store as planned".
- The billing decision (Shopify App Pricing, the Billing API for local-currency prices, usage caps or one-time charges, or mixed with the Shopify integration as its own line), the fees, the timeline forward from today by the browser clock, the submission packet with an owner role per item, and the Paused banner read for its type (no date, cooldown, reviewed), its date and its numbered requirements.
- Exports: the scopes (.csv), the checks (.csv), everything (.json), a listing lint report (.md, banned phrases in bold) and the fixed TOML (shopify.app.fixed.toml, written back through the parser: use_legacy_install_flow set to false, embedded = true only when a plan's fix for toml_embedded says so - never a scope, a URL or an id the page did not read; comments are not kept).
- Saved apps keep a compact snapshot of the checks: reopening one, or pasting an app of the same name, shows what changed since it was saved (checks fixed, checks newly failing, scopes removed or added, the fail count). "Mark as resubmitted" logs the date and how the app went back (Submit fixes, the cooldown date, or the reviewer's email); the next fixes run then carries the previous round's fixes with the plan.
- Two labels, kept distinct. Figures from shopify.dev carry a dagger: $19†, 0%† on the first $1M†, 15%†, $20M†, $100M†, 2.9%†, 30 characters†, 60 days† and 3 times a year†, 50 net installs† and 5 reviews†, LCP 2.5 s†, CLS 0.1†, INP 200 ms†, 100 calls in 28 days†, three months†, 7 days† and 30 days†, 2027-01-01† and 2027-04-01†, requirement 4.2†, expiring offline access tokens†, 1200 x 1200 px†, 1600 x 900 px†, five search terms†, billing fixes need no resubmission†. Forum and practitioner figures say "reported": plan 2-3 rounds and 6-14 weeks to Published (reported), about 30 days per review (reported), reported cooldowns run 2 weeks to a month, exemptions are rare (reported), reviewers fail apps where they can reach the Stripe path (reported).
- † from shopify.dev - Shopify changes requirements without notice; verify before relying on it. "reported" = forum or practitioner reports, not Shopify policy.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (plan or fixes), `app`, `config` (the TOML as read, or a line saying none), `billing`, `listing`, `review` (fixes only: the Paused banner or the reviewer's email), `carry` (fixes only: the plan's verdict, fixes and packet, plus the previous round's fixes once a resubmission is logged) and `facts`.
- `plan` replies with `summary`, `verdict` (`listable` yes or closed_as_planned, `distribution` limited_then_full, full_at_approval or custom, `why`), `billing` (`model` app_pricing, billing_api or mixed, `shopify_line`, `stripe_path`), `protected_data` (`level` none, level1 or level2, `request`), `fixes` (`check`, `change`), `packet` (`item`, `owner` a role, `done`), `timeline` (`step`, `wait`), `footnote` and `caveats`.
- `fixes` replies with `summary`, `banner` (`type` no_date, cooldown or reviewed, `date`), `points` (`n`, `requirement`, `fix`, `notes`, `check`), `resubmit` (`when`, `warning`), `reply` (each point on its own line), `footnote` and `caveats`.
A reply stays on the page when the form changes after it ran, under an out-of-date banner, and its downloads and copies keep working; each plan fix and each point copies on its own, and the fixes export a resubmission checklist (.md).
The page holds every reply to its own facts: the plan keeps the page's verdict, distribution rung, billing model and protected data level (a moved one is put back), carries every fail check as a fix, names packet owners by role and never marks an open packet item done; the fixes keep the banner type the text shows, give a date only when the text gives one, answer at least as many points as the text numbers (counted on their own lines or inline), never resubmit during a cooldown and answer the reviewer one point per line, never arguing and never asking to expedite; both carry the dagger on every shopify.dev figure and "reported" beside every forum figure (never a dagger on one), the legend line, no URL, no backticks, no invented price and no implied Shopify endorsement.

## Links
- API tutorial: https://shopify-submit.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/shopify-app-store-playbook
- Source repository: https://github.com/samber/developer-platform-skills