Overview

Follow these best practices to keep your app secure, fast, and compliant. They help you pass app review faster, protect merchant data, and deliver a better experience to merchants and their customers.

Security

Protect your app against common web vulnerabilities, encrypt traffic with TLS, prevent clickjacking with iframe protection, and generate and verify tokens securely.

Performance

Meet the Lighthouse benchmark, keep your app pages fast, streamline your OAuth flow, and keep the scripts you inject into storefront and checkout pages lean.

Privacy compliance

Understand your responsibilities under privacy laws such as GDPR: collect only the data you need, get consent, publish a privacy policy, and respond to data deletion requests.

Localization

Detect the merchant language from the session token or the Shop API, translate your app UI, and localize your app listing.

Accessibility

Build an app that works with keyboards, screen readers, and other assistive technology, with sufficient color contrast and touch-friendly targets.

Mobile support

Make sure your app works well when merchants manage their store from a mobile device.

Non-deceptive code

Write transparent code: no obfuscation, no cloaking, and no behavior that differs between review and production.