Shopify Essentials: Custom app development

A custom app is the answer when neither Shopify’s built-in features nor the App Store does what a store needs. It gives you control of the logic, the interface and where the data goes.

These are the decisions in order, whether the app is for one store or for the App Store.

1. Choose your stack

Shopify’s recommended starting point is the official app template, which uses React Router. Older apps and tutorials use its predecessor, Remix. You can also build the backend in Laravel, Rails or anything else that speaks HTTP, using your own database.

Scaffold a new app with Shopify CLI:

shopify app init

If you’d rather not install the CLI globally, npm runs the same scaffolder:

npm create @shopify/app@latest

The scope must be lowercase. npm create @Shopify/app@latest fails, because npm package scopes are always lowercase.

2. Embedded vs standalone

Embedded apps:

• Run inside Shopify Admin in an iframe
• Use App Bridge for navigation, modals and session tokens

Standalone apps:

• Run outside the admin, such as a CRM sync or an automation tool
• Don’t need an embedded UI

If merchants or staff will use the app day to day, embed it. They stay in the admin and don’t need a separate login.

3. App Bridge and Polaris

Use App Bridge for authentication and admin UI actions.

Use Polaris for the interface so the app looks and behaves like the rest of the admin. New apps use Polaris web components. Polaris React still works, and Shopify publishes a migration guide for apps moving across a route at a time.

4. Authentication

For embedded apps, Shopify recommends managed installation with token exchange. App Bridge gives your frontend a short-lived session token. Your backend checks it and exchanges it for an access token. There’s no OAuth redirect to hand-roll, and Shopify handles scope changes.

The official template does this for you. If you build without it:

• Verify every session token before trusting it
• Store access tokens encrypted, never in the frontend
• Keep the app’s client secret in environment variables, not in the repository

Standalone apps use the authorization code grant instead, because there is no App Bridge to supply a session token.

5. Use the GraphQL Admin API

Shopify made the REST Admin API legacy in October 2024, and new public apps have had to use GraphQL since April 2025. Write new code against GraphQL:

const response = await fetch(`https://${shop}/admin/api/2026-07/graphql.json`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Shopify-Access-Token": token,
  },
  body: JSON.stringify({
    query: `{ shop { name myshopifyDomain } }`,
  }),
});

Pin the API version and plan to update it. Shopify releases a new version each quarter and supports each one for at least a year.

6. Webhooks and background jobs

Webhooks tell the app when something happens in the store:

• orders/create
• app/uninstalled
• products/update

Respond to the webhook quickly, then do the work in a queue: Sidekiq, Laravel queues or a Node worker. Verify the HMAC signature on every webhook before acting on it.

7. The admin interface

• Give each screen one job
• Use Polaris components rather than custom styling
• Paginate large datasets with Polaris index tables
• Keep app settings in your own database, or in app-owned metafields if the storefront needs to read them

Launching

• Custom apps built for a single store or organisation don’t go through App Store review. They replaced the old “private apps”, which Shopify retired in 2022.
• Public apps for the App Store must meet Shopify’s App Store requirements

Related reading

• Shopify API integration best practices

---

If your store needs an app to link it to a system nothing in the App Store covers, connecting Shopify to other systems is part of what I do. Whoever builds yours, my guide to hiring a Shopify developer lists what to ask them first.