Most briefs for a Shopify app skip the one decision that cannot be undone cheaply: whether the app is distributed publicly or as a custom app. That choice decides whether Shopify reviews your code, whether you can charge merchants through Shopify at all, and how many stores can install it. Everything else on an agency proposal, the stack, the timeline, the day rate, is downstream of it. This guide sets out what Shopify itself publishes, so the question you put to a Shopify app development company is the right one.
Distribution is the first decision, and it is not a deployment detail
Shopify documents the distribution types on its app distribution page, read on 17 September 2026. Two of them are live options for a new build and two are closed.
| Distribution | Installs on | Shopify review | Shopify billing | Status |
|---|---|---|---|---|
| Public | Multiple Shopify stores | Required | Full access to the billing system | Live |
| Custom | One store, or multiple stores within the same Plus organisation, or transfer-disabled development stores | Not required | Cannot charge merchants through Shopify’s app billing system | Live |
| Shopify Admin | Single store | Not required | No | No longer available for new apps |
| Private | Single store | Not required | No | Deprecated January 2022, replaced by custom apps |
Two practical consequences follow. First, an agency that says it builds Shopify "private apps" is using a term Shopify retired in January 2022; ask which of the two live types they mean. Second, if the plan is to build a custom app for one merchant now and "list it later", that is not a configuration change. A public listing brings OAuth, App Bridge, Shopify App Pricing, a review submission and a support commitment that a single-store custom app never had to satisfy.
What Shopify requires before an app can be listed at all
Shopify’s app requirements checklist is the gate for a public listing. These are the items that most often send a first submission back, quoted from that page on 17 September 2026.
- OAuth first, every time. An app "should immediately authorize using OAuth before any other steps occur, even if the merchant has previously installed and then uninstalled your app". Apps that show a marketing screen or a signup form before authorising fail this.
- App Bridge for anything rendered in the admin. Embedded apps must "use Shopify App Bridge to ensure OAuth redirects to your app", and off-platform features are expected to be integrated into the admin rather than bounced to a separate site.
- Shopify App Pricing, not your own checkout. Apps must "use Shopify App Pricing to charge for your app", and merchants must be able to "upgrade and downgrade their pricing plan without having to contact your support team". A Stripe subscription bolted onto a Shopify app is a rejection.
- A storefront performance budget. An app "shouldn’t reduce Lighthouse performance scores by more than 10 points", measured across weighted pages: home 17%, product details 40%, collection 43%.
- A reviewable submission. Shopify asks for "clear instructions and a complete screencast showing your app’s setup process and functionality", plus working test credentials for any third-party integration.
- A privacy policy in the listing, and merchant data handled accordingly.
Read that list as scope. Each item is a week of work if it is designed in and a month if it is retrofitted. The billing requirement in particular reaches into the product: plan structure, upgrade paths and proration all have to be expressed in Shopify’s system rather than in yours.
Built for Shopify: the numbers a serious build has to hit
Built for Shopify is the badge that drives App Store placement, and unlike most platform programmes it publishes hard numbers. From Shopify’s Built for Shopify requirements, read on 17 September 2026.
| Requirement | Threshold Shopify publishes | Measured over |
|---|---|---|
| Net installs | Minimum of 50 net installs from active shops on paid plans | Cumulative |
| Reviews | Minimum of five reviews | Cumulative |
| Largest Contentful Paint | 2.5 seconds or less | 75th percentile, minimum 100 calls over 28 days |
| Cumulative Layout Shift | 0.1 or less | 75th percentile, minimum 100 calls over 28 days |
| Interaction to Next Paint | 200 milliseconds or less | 75th percentile, minimum 100 calls over 28 days |
| Storefront impact | Must not reduce the storefront Lighthouse performance score by more than ten points | Per measured page |
| Checkout requests | p95 of 500ms or less, with a 0.1% failure rate | Minimum 1000 requests over 28 days |
The web vitals rows are the ones that decide architecture. An admin surface that hits an LCP of 2.5 seconds at the 75th percentile is not a heavy client-side application that fetches everything after mount. It is server-rendered or aggressively pre-fetched, with the first meaningful data in the first response. That is a decision made in week one, not tuned in week twelve.
It is also worth noticing what the install and review thresholds mean commercially: Built for Shopify cannot be bought or scheduled. Fifty net installs on paid plans and five reviews are outcomes of distribution, so any proposal that promises the badge on a delivery date is promising something the supplier does not control.
Where a Shopify app build actually overruns
The visible part of a Shopify app, the admin screens, is rarely what consumes the schedule. The same pattern shows up in portal work, which we wrote about in custom portal development costs and timelines: the plumbing is estimated casually and then takes twice as long as the screens.
The API and data layer underneath is ordinary work, and the patterns we use are in building a REST API with Node, Express and PostgreSQL, with the production hardening in our Node security guide. It is the Shopify-specific surface above that separates a team that has shipped an app from a team that has shipped a web application.
Six questions for a Shopify app development company
Ask these on the first call. The answers separate teams who have been through App Store review from teams who have read about it. Our wider procurement guide, how to choose a custom software development company, covers the commercial side.
- Which distribution type are you proposing, and why? If the answer is "private app", they are quoting on a model Shopify retired in January 2022.
- How will merchants be charged? The only correct answer for a public app is Shopify App Pricing, with self-service upgrade and downgrade.
- What is your plan for missed webhooks? Anything other than a reconciliation job means the data will drift.
- How do you handle Admin API rate limits for a large catalogue? Listen for cost-based throttling and batching, not for "we add a delay".
- Have you passed App Store review, and what came back the first time? Everyone gets something back. A team that cannot name what theirs was has not been through it.
- What are the web vitals targets for the admin surface, and how are they measured? If the numbers are not in the proposal, the architecture has not been chosen with them in mind.
When an app is the wrong answer
A meaningful share of Shopify app briefs describe something that does not need an app. Three cases come up repeatedly.
- One store, one workflow, no distribution plan. This is a custom app at most, often a scheduled script against the Admin API, and it should be scoped as an integration rather than as a product.
- A storefront behaviour change. Merchandising, filtering and display changes usually belong in the theme or in a theme app extension. We covered the equivalent problem on another platform in custom filters for Wix stores, and the reasoning transfers: a front-end requirement does not justify a distributed application.
- A conversational or support layer. If the goal is to answer shopper questions and recover carts, that is a channel problem rather than an app-platform problem. Our conversational commerce guide and the Shopify AI agent guide cover the alternatives, and ConvertPilot is our own productised version.
The reason to put that section in a page about hiring a Shopify app development company is that the opposite advice is what most agency pages give, and it is wrong often enough to be worth correcting. Building a public app is a commitment to a product with merchants, reviews, support and a performance budget measured every 28 days. It is worth making deliberately.
Examples of the commerce and integration work we have shipped are on our work page, and what we do on this platform specifically is on our Shopify app development page. If you want a second opinion on whether your brief is a public app, a custom app or a script, send us the brief and we will tell you which one it is.