Shopify's app requirements checklist says an app should authorize with OAuth immediately on install, use session tokens when rendered in the admin, request only the access scopes it needs, and include a privacy policy in its listing. For merchants, scopes are the clearest security signal on the grant page.
What the checklist says
From the app requirements checklist:
- Installation: the app should immediately authorize using OAuth before any other steps occur, including for merchants who uninstalled and reinstalled. Pop-up windows should not be used for essential functions such as OAuth or approving charges.
- Session tokens: use session tokens for authentication in apps rendered in the Shopify admin, and avoid third-party cookies and local storage.
- Scopes: request only the access scopes the app needs (requirement 3.2). Merchants see the requested permissions on the OAuth grant page and can grant or decline them.
- Mobile builders: keep client secrets and access tokens on a secure web server, not on mobile devices.
- Privacy policy: a privacy policy is required in the listing.
- Payments: use a PCI-compliant gateway for payments and donations.
The page does not detail transport security or privacy webhooks, so do not read those into it.
Why each rule helps
| Rule | Threat it reduces |
|---|---|
| Authorize first with OAuth | Apps acting before the merchant has granted anything |
| Session tokens in admin | Reliance on third party cookies that can leak or fail |
| Minimal scopes | Over-broad access if the app or its vendor is breached |
| Secrets on a server | Tokens extracted from a mobile app package |
| Privacy policy | Unclear data use |
A merchant's review before clicking install
- Open the grant page and read each permission.
- Ask what feature needs it. A reviews widget does not need to read customer personal data.
- Look for a privacy policy that matches the permissions.
- Check the vendor's support contact and update history.
- Install on a development store first if the app touches orders or customers.
Write down the decision. If a scope later expands, you will want to compare.
Scope creep after install
Apps change. A new version can ask for more access, and merchants may be asked to approve it. Treat that approval like a fresh install. Remove apps you no longer use, since an unused app with order access is still a path to your data if the vendor is compromised.
Remember what a store listing cannot tell you: whether the vendor patches its own dependencies quickly, how it stores your merchant tokens, and whether its backend is hardened. Ask for a short security statement before approving anything that reads customer data.
For developers building an app
Keep the access scopes list in your repository and review it with each release. Remove any scope that no feature uses. Keep tokens off clients. Avoid third party cookies for authentication. These are cheap habits that match what the checklist already asks.
Safeguard's SBOM and dependency scanning can check the libraries in an app's backend, which is where many app incidents begin.
Quick check
Can merchants decline a requested scope?
The checklist says merchants see the requested permissions on the grant page and can grant or decline them.
Where should an app keep its tokens?
On a secure server, not on a mobile device, according to the checklist's guidance for mobile app builders.
Does the checklist cover everything about app security?
No. It focuses on installation, authentication, scopes and listing requirements. Vendor practices still need your own review.
Sources
Last reviewed: 19 October 2026.
