We submitted SellRank to the Shopify App Store on September 25, 2026. The checklist we worked through, from the AI self-review and the no-shop-domain rule to protected customer data, privacy webhooks, the screencast and the listing, and what each review status means while you wait.
On Friday, September 25, 2026, we submitted SellRank, our collection sorting app, to the Shopify App Store. As we write this it is in the queue, waiting for a reviewer. This post is the checklist we worked through before pressing Submit, written while it is fresh and before we know the outcome.
Shopify's requirements are public and detailed, and we give the requirement numbers so you can look each one up. What follows is the order we would tackle them in, and the ones that caught us out.
How review works in 2026
Every public app starts as a Draft. The App Store review page in the Partner Dashboard runs automated checks and collects your listing, configuration and data details, and you can only submit once it is satisfied. After that, an app moves through these statuses.
- Submitted: Shopify has your app and emails you to confirm it. A reviewer is assigned once the app meets the core requirements.
- Paused: something prevents a reviewer from starting. You get an email listing the required changes, and you resubmit with Submit fixes.
- Reviewed: the reviewer found issues to discuss, and you reply to continue.
- Published: approved, confirmed by email, and listed on the App Store.
Since April 2026, reviewer feedback lives in the Partner Dashboard on the app's Distribution page, with a status for each requirement, and you cannot resubmit until every flagged item is resolved. Review emails go to the address in your listing's contact information, so add noreply@shopify.com to your allowed senders.
1. Run the AI self-review first
Shopify's AI Toolkit includes a self-review skill, run as /shopify-app-store-review from an AI agent working in your project. It checks your codebase against every App Store requirement that can be judged from code, and reports what is likely passing, what is likely failing, and what needs a person to look at. It does not cover your listing, your app's live behaviour or its merchant experience, and Shopify's reviewers still check everything.
Run it early. Ours found something we had carried since the first day without noticing, which is the next point.
2. Remove the shop-domain login form
Requirement 2.3.1 says an app must be installed and launched only from Shopify, and must never ask a merchant to type a myshopify.com address or a store's domain. The app template we started from ships with a login page that does exactly that: a form asking for the shop's domain. It is convenient in development, and not allowed in a submitted app.
We removed it. SellRank's public page now tells merchants to open the app from Apps in their Shopify admin, and the login route only redirects when Shopify itself supplies the store. While you are there, check the neighbouring rules: authenticate with OAuth immediately after install and after any reinstall, before a merchant can touch the interface, then take them straight into the app (requirements 2.3.2 to 2.3.4).
3. Request protected customer data before you submit
If your app reads orders or customers, it handles protected customer data, and Shopify grades that in levels. Level 1 covers customer data without names, addresses, phone numbers or emails. Level 2 includes those fields and brings stricter requirements. You request access in the Partner Dashboard, explain why you need each item, and Shopify approves access when it is the minimum the app needs to work.
SellRank reads orders to rank products by sales, so it asked for Level 1 and nothing more. Its storefront pixel counts views and add-to-carts as daily totals per product, with no customer identifiers. Do this before you submit: Shopify's documentation says protected customer data cannot be requested while an app is under review.
4. Get the privacy webhooks exactly right
Every App Store app must subscribe to three compliance webhooks: customers/data_request, customers/redact and shop/redact. Each must accept a JSON POST, answer with a status in the 200 range, and reject a request with an invalid signature with a 401. The action itself, such as deleting a store's data, has to be completed within 30 days.
Test them with a store that has uninstalled your app, not only with a live one. shop/redact arrives 48 hours after an uninstall, when your app no longer has access to the store, and that is exactly when a template-based app with expiring tokens can fail. We have written that story up separately.
5. Check the configuration details that trip people up
- Embedded apps must use session tokens, and must work without third-party cookies or local storage, including in Chrome's incognito mode (requirement 1.1.1).
- All charges must go through Shopify App Pricing or the Billing API (requirement 1.2.1). Test upgrades and downgrades between plans, not only the first purchase.
- The app icon is 1200 by 1200 pixels, in JPEG or PNG.
- Your app's URLs must not contain the words Shopify or Example, and the API contact email must not contain Shopify.
- Add an emergency developer contact to your Partner account (requirement 4.5.6).
- Use supported APIs only. Shopify's guidance is that apps using APIs due to be deprecated within 90 days cannot be submitted.
6. Make the reviewer's job easy
Reviewers set up and test your app from your instructions, so write them as numbered steps a stranger could follow. Requirement 4.5.3 asks for a screencast that shows onboarding and the features your listing describes, in English or with English subtitles. If your app needs a login to anything outside Shopify, include working credentials with full access (requirements 4.5.4 and 4.5.5).
Shopify's list of common review problems is worth reading before you submit. Several of them send an app back for resubmission: an install that does not go straight to the permissions screen, an app that errors after install or on reinstall, missing testing instructions, and pages that return 404s or 500s. Make sure your app responds quickly at any hour, because reviewers work across time zones.
7. The listing
- Screenshots are 1600 by 900 pixels. Use three to six desktop screenshots, at least one of the app itself, with the browser chrome cropped out and alt text on each.
- Keep pricing, reviews, statistics, links and personal data out of your screenshots and listing copy. Shopify runs AI-assisted checks on English listings for these. Flags do not block submission, but fixing them avoids delays.
- The app introduction has 100 characters. Spend them on what the merchant gets, not on keywords.
- A demo store URL helps merchants see the app working. Link to the page that shows its effect best.
- Feature media works best as a short promotional video of two to three minutes, with screen recording kept to about a quarter of it.
8. While you wait
We are treating the review period as a feature freeze: bug fixes only, and nothing that changes what the reviewer is testing against our instructions and screencast. The app is monitored, the test store is ready, and the inbox that receives review emails is watched. We will know soon enough whether this checklist was complete.
