1. Two ways to publish a Shopify app
Before diving into the submission process, understand that there are two distinct ways to get a Shopify app into merchants' hands — and they have very different requirements.
Public App Store listing
Your app appears in the public Shopify App Store, searchable by 2M+ merchants. This requires passing Shopify's full review process and accepting their revenue share — 0% on your first $1,000,000 in lifetime revenue, then 15% above that. In exchange, you get organic discovery, trust signals (reviews, install counts), and potential editorial promotion. This is what most people mean by "publishing a Shopify app."
Custom distribution (private)
You generate a private install link and share it directly with specific merchants. No App Store review, no revenue share, and you're live immediately. The tradeoff: no organic discovery — you own all acquisition. This is ideal for apps targeting a specific audience, agency tools, or apps in early validation.
Start with custom distribution. Get your first 20–50 merchants, collect feedback and reviews, and validate the product — all without waiting for review or paying revenue share. Then submit for public App Store listing once you have traction. This guide focuses on the public listing process, since custom distribution requires no submission at all.
2. Prerequisites — what you need before submitting
A Shopify Partner account
Sign up free at partners.shopify.com. This is where you create your app, get your API credentials, manage your listing, and receive payouts. Creating the account takes a few minutes and requires basic business details.
A working, deployed app
Your app must be live at a public HTTPS URL before you submit — reviewers will install and test it. The app needs correct OAuth (with HMAC verification), App Bridge embedding, the Billing API (if you charge), webhook handlers, and the three mandatory GDPR webhook endpoints. If you built your app with an AI builder like Shopivibe, these are included by default.
A development store for testing
Partner accounts include unlimited free development stores. Use one (ideally several) to test the complete install-to-uninstall flow before submitting. Reviewers test on their own store, so anything that breaks on a fresh store will break during review.
Required legal and policy pages
You need a live, accessible privacy policy URL. If your app handles customer data (most do), the privacy policy must describe what data you collect, how you use it, and how merchants/customers can request deletion. A 404 on your privacy policy URL is an automatic rejection.
3. Pre-submission technical checklist
Run through every item before submitting. Each of these is something reviewers actively check:
- OAuth with HMAC verification: The install flow must validate Shopify's HMAC signature on the callback before processing. Test a fresh install on a development store.
- App Bridge initialized: Your embedded app must load App Bridge on every page. Verify navigation, toasts, and session token refresh work inside the Shopify admin frame.
- Billing API (if charging): The billing flow must create a charge, redirect to Shopify's confirmation page, and activate on approval. Test approving and declining a charge.
- Three GDPR webhooks:
customers/redact,shop/redact, andcustomers/data_requestmust be registered and return 200. This is the single most common rejection cause. - Webhook HMAC verification: All incoming webhooks must be verified with HMAC-SHA256 using your app secret.
- Clean install/uninstall/reinstall cycle: A merchant who installs, uninstalls, and reinstalls should get a working app each time. Test this exact sequence.
- Empty states: Every admin screen must render correctly on a fresh store with no data. Reviewers test on empty stores.
- No crashes: Click through every screen, every action, every form. Any unhandled error during review is a rejection.
- Privacy policy live: Confirm the URL returns a real page, not a 404 or placeholder.
The most reliable way to pass review on the first try is to test the entire flow on at least 3 brand-new development stores. Issues that don't appear on your main test store — empty states, first-install edge cases, fresh OAuth — surface on fresh stores, which is exactly what reviewers use.
4. Listing assets — what merchants see
Your App Store listing is a conversion page. These assets determine whether merchants who find your app actually install it:
App name
Your app name should contain the primary keyword merchants search for, not just your brand. "Loyalty Rewards — Points & Referrals" ranks and converts better than "BrandName." Shopify has character limits and rules against keyword stuffing, so balance discoverability with clarity. See the App Store SEO guide for keyword strategy.
App icon
A clean, recognizable icon at the required dimensions. It appears in search results and on your listing. Simple, high-contrast icons perform better than detailed ones at small sizes. Avoid text in the icon — it's illegible at thumbnail size.
Screenshots
The most important visual conversion element. Show your app's actual interface with annotations highlighting key benefits. The first screenshot matters most — it's visible without scrolling. Lead with your strongest value proposition. Use real UI, not abstract marketing graphics. 4–6 screenshots is standard.
App listing description
Open with the core value proposition in the first sentence — merchants scan, they don't read. Use short paragraphs and bullet points for features. Include secondary keywords naturally for search ranking. Describe outcomes ("increase repeat purchases") alongside features ("points-based rewards"). End with a clear statement of what's included in each pricing tier.
Demo video (optional but recommended)
A 30–60 second video showing the app in action significantly improves conversion. Show the merchant experience: install, set up, and the result. Listings with videos consistently outperform those without.
5. The submission process step by step
Step 1: Complete your app configuration
In the Partner Dashboard, configure your app's URLs (app URL, redirect URLs), API scopes (request only what you actually use — over-requesting scopes triggers review scrutiny), and webhook subscriptions including the GDPR webhooks.
Step 2: Fill in the app listing
Add your name, icon, screenshots, description, pricing details, support contact, and privacy policy URL. Complete every required field — incomplete listings can't be submitted.
Step 3: Set up your pricing
Define your pricing plans in the listing. These should match what your app actually charges via the Billing API. Mismatches between listed pricing and actual billing are a rejection cause. See the pricing guide for how to structure tiers.
Step 4: Provide test instructions
In the submission notes, give reviewers clear instructions: how to set up the app, what to test, and any demo credentials they need. Reviewers who can't figure out how to test your app will reject it. Make their job easy — a well-written test guide measurably improves first-pass approval.
Step 5: Submit for review
Submit and wait. The initial review takes 5–10 business days. You'll receive an email with the result — either an approval or a list of issues to fix. Don't deploy major changes to your app while it's under review, as reviewers test the live version.
6. What reviewers actually test
A Shopify reviewer installs your app on a test store and uses it as a merchant would. Understanding their process helps you pre-empt failures:
- Installation: They complete the OAuth flow. Broken OAuth, missing HMAC verification, or install errors fail here.
- Embedded experience: They navigate your admin UI. Broken App Bridge, layout issues inside the iframe, or navigation that doesn't work fails here.
- Core functionality: They use your app's main features. Crashes, errors, or features that don't work as described fail here.
- Billing: If you charge, they go through the billing flow and approve a charge. A billing flow that doesn't activate the subscription fails here.
- Uninstall: They uninstall the app, verifying your
shop/redactwebhook fires and you handle the cleanup. Apps that don't process uninstall correctly fail here. - GDPR webhooks: They verify all three mandatory webhooks are registered and respond correctly.
- Listing accuracy: They check that your app does what your listing claims. Misleading descriptions or screenshots that don't match the actual app fail here.
7. Common rejection reasons — and how to fix them
| Rejection reason | How to fix |
|---|---|
| Missing GDPR webhooks | Implement all three (customers/redact, shop/redact, customers/data_request), verify HMAC, return 200 |
| App crashes during testing | Test every screen on fresh stores; add error handling and empty states |
| Privacy policy 404 | Publish a real privacy policy at the URL you provided |
| Billing flow broken | Test the full charge → confirm → activate cycle; verify the activation webhook |
| Over-requested scopes | Request only the API scopes your app actually uses |
| Listing doesn't match app | Update screenshots and description to reflect actual functionality |
| Install/reinstall broken | Handle the returning-merchant case; test install → uninstall → reinstall |
| Unclear test instructions | Write step-by-step testing notes with demo credentials |
The single most common rejection is missing or broken GDPR webhooks. If you build your app with a Shopify-specific generator, these are included correctly by default — which is a major reason such apps pass review where generically-built apps fail repeatedly.
8. After approval — launching successfully
Approval is the start, not the finish. A listed app with no marketing gets a handful of installs. Here's what to do immediately after going live:
Optimize for App Store search
Your ranking in App Store search drives organic installs. Optimize your name, description keywords, and screenshots, and focus on install velocity and reviews. The App Store SEO guide covers this in depth.
Collect reviews early
Reviews drive both ranking and conversion. Ask your beta merchants (the ones from custom distribution) to leave reviews now that you're listed. Prompt active merchants at moments of value delivery. Never incentivize reviews — that violates Shopify's terms.
Monitor and respond to reviews
Respond professionally to every review, especially negative ones. A thoughtful response to a 1-star review demonstrates responsiveness to potential installers evaluating your app.
Watch your metrics
The Partner Dashboard shows installs, uninstalls, and revenue. Watch your 7-day uninstall rate closely — high uninstalls signal an onboarding or value problem and hurt your ranking. Use the SaaS growth guide for the full playbook on acquisition and retention.