Shopify Apps
Build Shopify apps with modern embedded-app architecture, App Bridge, React Router/Remix conventions, Admin GraphQL, Polaris, billing, webhooks, and extensions. Treat platform requirements, secrets, rate limits, and App Store review constraints as part of the implementation, not cleanup.
When to Use
Starting or modifying a Shopify embedded app, admin surface, app extension, billing flow, or webhook pipeline.
Using Shopify Admin GraphQL, Polaris, App Bridge, session storage, or protected customer data.
Reviewing code for Shopify platform pitfalls such as duplicate webhook registration, REST usage, missing GDPR webhooks, or synchronous webhook work.
When Not to Use
The task is a storefront theme-only change with no app backend, Admin API, extension, or embedded admin surface.
The request depends on protected customer data without approved access and graceful fallback behavior.
The app would store sessions in memory or expose Shopify secrets to client code.
Core Workflow
Confirm the app surface: embedded admin app, extension, webhook handler, billing, GraphQL integration, or protected-data flow.
Set up server-side authentication, durable session storage, environment secrets, App Bridge, and Polaris before building feature screens.
Prefer Admin GraphQL for new work and design around rate limits, bulk operations, and retry behavior.
Configure webhooks in shopify.app.toml, validate HMAC/signatures, respond within five seconds, and process slow work asynchronously.
Implement required GDPR and compliance handlers even when the app stores minimal data.
Test install, auth callback, embedded loading, webhook delivery, billing states, extension deployment, and App Store review checks.
Reference Map
Read references/full-guidance.md when the task needs the complete examples and edge cases. It includes:
React Router app setup, embedded App Bridge layout, webhook handling, GraphQL Admin API, billing, and app-extension templates.
Sharp edges for five-second webhooks, API rate limits, protected customer data, duplicate webhooks, trailing slashes, REST migration, App Bridge, and GDPR handlers.
Validation checks for hardcoded Shopify secrets, missing HMAC, synchronous webhooks, REST API usage, in-memory sessions, and missing session validation.
Safety and Quality Rules
Never expose Shopify API secret, access tokens, or session data to client code.
Do not rely on in-memory session storage outside throwaway local development.
Treat webhook validation and async processing as required production behavior.
Progressive Loading
Start with this entrypoint for routing and planning. Load references/full-guidance.md only after the task clearly requires deep implementation detail, code examples, validation checklists, or troubleshooting guidance.
1---2name: shopify-apps3description: Use when building or auditing Shopify apps with React Router/Remix, App Bridge, Admin GraphQL, Polaris, webhooks, billing, or app extensions.4license: MIT5---67# Shopify Apps89Build Shopify apps with modern embedded-app architecture, App Bridge, React Router/Remix conventions, Admin GraphQL, Polaris, billing, webhooks, and extensions. Treat platform requirements, secrets, rate limits, and App Store review constraints as part of the implementation, not cleanup.1011## When to Use1213- Starting or modifying a Shopify embedded app, admin surface, app extension, billing flow, or webhook pipeline.1415- Using Shopify Admin GraphQL, Polaris, App Bridge, session storage, or protected customer data.1617- Reviewing code for Shopify platform pitfalls such as duplicate webhook registration, REST usage, missing GDPR webhooks, or synchronous webhook work.1819## When Not to Use2021- The task is a storefront theme-only change with no app backend, Admin API, extension, or embedded admin surface.2223- The request depends on protected customer data without approved access and graceful fallback behavior.2425- The app would store sessions in memory or expose Shopify secrets to client code.2627## Core Workflow28291. Confirm the app surface: embedded admin app, extension, webhook handler, billing, GraphQL integration, or protected-data flow.30312. Set up server-side authentication, durable session storage, environment secrets, App Bridge, and Polaris before building feature screens.32333. Prefer Admin GraphQL for new work and design around rate limits, bulk operations, and retry behavior.34354. Configure webhooks in `shopify.app.toml`, validate HMAC/signatures, respond within five seconds, and process slow work asynchronously.36375. Implement required GDPR and compliance handlers even when the app stores minimal data.38396. Test install, auth callback, embedded loading, webhook delivery, billing states, extension deployment, and App Store review checks.4041## Reference Map4243Read `references/full-guidance.md` when the task needs the complete examples and edge cases. It includes:4445- React Router app setup, embedded App Bridge layout, webhook handling, GraphQL Admin API, billing, and app-extension templates.4647- Sharp edges for five-second webhooks, API rate limits, protected customer data, duplicate webhooks, trailing slashes, REST migration, App Bridge, and GDPR handlers.4849- Validation checks for hardcoded Shopify secrets, missing HMAC, synchronous webhooks, REST API usage, in-memory sessions, and missing session validation.5051## Safety and Quality Rules5253- Never expose Shopify API secret, access tokens, or session data to client code.5455- Do not rely on in-memory session storage outside throwaway local development.5657- Treat webhook validation and async processing as required production behavior.5859## Progressive Loading6061Start with this entrypoint for routing and planning. Load `references/full-guidance.md` only after the task clearly requires deep implementation detail, code examples, validation checklists, or troubleshooting guidance.
newmindsgroup