Shopify app testing
Your app runs inside someone else's product, in front of someone else's customers. The bar for 'works' is higher than it looks.
Shopify apps fail App Store review for unglamorous reasons. In the rejected apps we have been asked to rescue, the same faults keep appearing: OAuth that breaks when a merchant uninstalls and reinstalls, missing mandatory GDPR webhooks, and embedded apps that misbehave inside the admin iframe. None of these show up if you only ever test the happy path on your own development store.
The uninstall and reinstall cycle deserves particular attention. Merchants do it casually, sometimes just to troubleshoot. Your app has to handle revoked tokens, replayed webhooks and stale database rows for a shop that left and came back. We script that whole cycle and run it against every release candidate.
Webhooks are the other quiet failure point. Shopify signs them, retries them, and will eventually give up on you. We test HMAC verification with tampered payloads, duplicate deliveries (they happen, so your handlers need to be idempotent), and what your app does during a burst that brushes against the REST rate limit's leaky bucket.
Theme surface matters too. A theme app extension that looks right on Dawn can collapse on a heavily customised paid theme. We keep a set of popular themes and test your storefront-facing components on each, at mobile widths first, because that is how shoppers will meet them.
A small confession: we cannot promise your app passes review first time. Shopify's reviewers add requirements faster than any checklist can track. What we can do is remove the failures that are predictable, which in our experience is most of them.
App review readiness
OAuth, billing, mandatory webhooks and embedded-app behaviour checked before you submit.
Webhook reliability
HMAC verification, duplicate deliveries and rate-limit behaviour under bursts.
Merchant lifecycle
Install, configure, uninstall, reinstall and plan changes, scripted and repeatable.
Theme compatibility
Storefront components tested across popular themes at mobile and desktop widths.
Frequently asked questions
What should we test before submitting a Shopify app for review?
The flows Shopify's review team and your first merchants will both hit: clean install and uninstall (including what happens to your webhooks and stored data), OAuth and permission scopes, billing activation and cancellation, and behaviour on a store with messy real-world data — thousands of products, draft orders, multiple currencies. Most rejections and early bad reviews come from the install/billing path, not the core feature.
How do you test against Shopify API changes and version deprecations?
Shopify retires API versions on a quarterly cycle, and apps break quietly when a deprecated field finally disappears. We test your app against the API version you target and the next one, watch the deprecation headers in responses, and exercise your webhook handling for the retries and out-of-order deliveries Shopify actually sends. An app that survives a version bump without a support-ticket spike is a tested app.
Can you test our app across different merchant store configurations?
Yes, on development stores set up to be awkward on purpose: multiple locations, markets and currencies, hundreds of variants, other popular apps installed alongside yours, and themes beyond the default. Merchant environments vary more than app developers expect, and 'works on my dev store' is the Shopify version of 'works on my machine'.
Do you test the billing flows for paid Shopify apps?
Yes, in test-charge mode: subscription approval, declined and abandoned approvals, plan upgrades and downgrades mid-cycle, trial expiry, and uninstall-with-active-subscription. Billing bugs are disproportionately expensive for app developers because they cost money and reviews at the same time, and the merchant experiencing one has your app's uninstall button right there.
Why was my Shopify app rejected?
The rejection developers report most is 'unable to test the app since it is not working', which is usually an environment mismatch: the app runs on your development store but fails in the reviewer's fresh store because of missing onboarding states, embed extensions disabled by default, OAuth failing on reinstall, or billing screens that assume existing data. Shopify's feedback is often vague, so the practical fix is to test on a clean store exactly as a reviewer would before every submission. Each failed submission costs you another wait in the review queue.
How do I test Shopify webhooks properly?
Never assume delivery: developers report order and checkout webhooks arriving for as little as 30% of events on some stores, and Shopify stops retrying after eight failed attempts. Test that your endpoint responds within five seconds, that handlers are idempotent because duplicates do happen, and that a reconciliation job backfills missed orders from the API. Test the uninstall path too; your access token is already invalid when app/uninstalled fires, which breaks naive cleanup code.
How do I handle app uninstall and reinstall without losing merchant data?
Shopify sends the shop/redact webhook 48 hours after uninstall, and you must delete the shop's personal data when it arrives. The trap is the reinstall-within-48-hours case: if deletion is keyed purely on shop domain or ID, the delayed redact webhook can wipe data for a merchant who has already come back. Test the full uninstall, reinstall and redact sequence explicitly, including OAuth on reinstall; apps have been rejected for failing exactly this flow.
Ready to improve your software quality?
Tell us about your product and we'll get back to you with a plan.
Contact Us