A pre-install checklist for Shopify apps

Start with the store task

Before comparing features, write down the task the app needs to handle and what a useful result would look like in your store. Then compare that need with the app’s described functionality and features. This keeps the decision anchored to your workflow rather than to a long feature list.

Shopify requires App Store apps to deliver the functionality described in their listing. App details should explain the app’s functionality and features clearly enough for merchants to make an informed installation decision.

Check that the listing’s primary functions match the job you need done; app listing tags should accurately reflect those primary functions. If the description leaves a key part of the task unclear, ask the developer to clarify it before installation. A feature that sounds relevant is not a substitute for understanding what the app says it does.

Compare the listing details

Once the app appears to fit, use its listing to check practical requirements that could affect your decision: what it costs, where it works, and what store setup or access it needs. Treat unclear or missing details as questions to resolve, rather than assumptions about how the app will work in your store.

App listings should provide complete pricing information, including trial duration and charge details. Review those details against your intended use so you understand the listed options and charges before installing.

Listings should disclose geographic requirements or specific API permissions needed for the app to work. If an app’s embedded features depend on the Online Store channel, its listing should indicate that requirement. Compare each disclosed requirement with your store’s setup and intended use; if a requirement is not clear, ask whether it affects the features you plan to use.

Check the installation route

Before approving an installation, note where the app is coming from: the Shopify App Store, a third-party install link, or a custom app link provided by a developer. The route gives useful context for interpreting the installation flow and any warning you see.

An app can be installed through the Shopify App Store, a third-party install link, or a developer-provided custom app link. A third-party install warning means the app has not gone through the verification and approval process required for App Store listings; Shopify says this does not necessarily mean it is unsafe.

Treat the warning as information about the app’s review route, not as proof that the app is safe or unsafe. If you are considering an app from a third-party or developer-provided link, make sure you know who supplied it and why that route is being used. Then continue with the same checks of the app’s stated purpose, requirements, requested access, and privacy information.

Inspect access before approving

On the installation screen, pause to review what data and store areas the app says it needs before you approve it. Installation access categories are the groups Shopify presents to distinguish personal-data access from store-data access that can be viewed or edited.

Expand each access category to inspect the specific permissions requested. Don’t stop at the category names: compare the detailed permissions with the functions you expect to use, and note anything you cannot connect to those functions.

The installation screen links to the developer’s privacy policy, which you can review before installing. Use it to look for an explanation of how the developer handles data, especially personal data. If the policy or the requested permissions leave you unsure what data is processed and why, ask the developer before proceeding.

After installation, you can revisit the app’s activity and permissions from its about page. That gives merchants a way to return to the access details later, but it does not replace reviewing the request before approving installation.

For developer review, examine scopes

Merchants can inspect the permissions presented during installation; developers may need to investigate how those requests are configured and whether they are necessary. API scopes define what data and features an app can access, so compare the requested scopes with the app’s functionality rather than treating access as a routine installation detail.

For a custom app built in the Dev Dashboard, the developer defines accessible data and features through API scopes, and scopes can differ between versions. Review the scopes for the version intended for installation, and check whether a scope supports a feature the merchant plans to use.

Shopify requires apps to request only the access scopes necessary for their functionality, and developers may be asked to justify those scopes. For access that is not required for every merchant, Shopify strongly encourages developers to use optional scopes. These are useful checks when a request appears broader than the described function: ask what function requires it, whether all merchants need it, and whether it can be optional.

Shopify says generating an access token for a Dev Dashboard custom app requires developer knowledge and cannot be completed directly from Shopify admin. For that kind of review, separate what the merchant can confirm in the installation flow from what a developer must inspect in the app configuration.

Use protected customer data guidance

Protected customer data is customer information subject to Shopify’s requirements for data use and access. Shopify’s guidance frames those requirements around minimizing data, transparency, and security, which gives merchants and developers a practical basis for discussing customer-data requests.

Shopify describes access approval as depending on whether the requested customer data is the minimum needed for the app’s merchant-facing functionality. Developers are also expected to process only the personal data needed for app functionality and to tell merchants what personal data they process and why. Ask the developer to connect each requested data type to a specific app function, and to explain why that information is needed.

Shopify’s API responses include only approved fields, and unapproved fields are redacted. These details matter most in a deeper developer review: identify which customer data the app needs, what approval applies, and whether its stated function can be supported with less data.

A useful final decision is one where the app’s task, listing disclosures, installation route, and requested access all make sense together. If any link in that chain is unclear, hold off on recommending or installing the app until the merchant and developer have resolved the question.