Understanding Shopify's App Distribution Models
Shopify has evolved its app architecture over time. Terms like private apps, custom apps, and public apps can be confusing. This article clarifies the current options and helps you choose the right model.
The Deprecated Private Apps
Private apps were the original method for single-store custom development. They used simple API keys and were created directly in a store's admin.
Why Shopify deprecated them
Private apps had security limitations. They used static API credentials that could not rotate easily. They lacked the audit trails and permission controls of OAuth-based apps.
Shopify deprecated private apps in January 2022. Existing private apps continue to work, but new ones cannot be created.
If you have existing private apps
They still function, but plan to migrate to custom apps. Future API changes may require OAuth authentication, making legacy private apps incompatible.
Custom Apps: The Current Standard
Custom apps are the replacement for private apps. They are built in the Shopify Partner dashboard and installed on specific stores.
How custom apps work
- Created in Partner dashboard, not store admin
- Use OAuth for authentication
- Installed on specific stores you designate
- Full API access like public apps
- Can use app extensions, webhooks, and other platform features
When to use custom apps
Custom apps are appropriate for:
- Internal tools for your own store
- Client projects where you build for a specific merchant
- Integrations that only need to work on one or a few stores
- Development and testing before public release
Custom app advantages
- No app review process required
- No App Store listing needed
- Direct installation on target stores
- Full control over functionality and updates
Public Apps: The App Store Model
Public apps are listed in the Shopify App Store and available to any merchant.
When to build public apps
Public apps make sense when:
- You want to monetize by selling to multiple merchants
- You are building a SaaS product on Shopify
- You want broad distribution and discoverability
- Your solution solves common problems for many stores
Public app requirements
Public apps must pass Shopify's review process, which checks:
- Security and privacy compliance
- User experience standards
- Billing and merchant agreement compliance
- Performance and reliability
Ongoing obligations
Public apps require:
- Support for all installed merchants
- Maintenance for API version updates
- Compliance with App Store policies
- Response to Shopify review feedback
Choosing Between Models
The choice depends on your goals and resources.
Build a custom app if:
- You need functionality for one store or a specific client
- You want to avoid App Store review
- You do not plan to monetize the app broadly
- You need proprietary features not for public distribution
Build a public app if:
- You want to sell to many merchants
- You are building a product, not a client project
- You can support multiple customers
- App Store visibility matters for distribution
Hybrid approaches
Some teams start with custom apps for specific clients, then generalize into public apps. This lets you validate demand before investing in broad distribution.
Technical Differences
From a development perspective, custom and public apps are similar.
Same APIs and extensions
Both app types access the same Admin API, use the same webhooks, and can implement the same app extensions. The code is largely interchangeable.
Authentication differences
Both use OAuth, but installation flows differ. Custom apps install directly on designated stores. Public apps install through the App Store with merchant consent.
Billing differences
Public apps typically use Shopify's billing API to charge merchants. Custom apps often have billing handled separately through client agreements.
Security Considerations
Custom apps and public apps both use OAuth, providing better security than legacy private apps.
Token management
OAuth tokens can be scoped to specific permissions. Unlike private app API keys, tokens can be revoked and reissued without recreating the app.
Audit trails
OAuth-based apps provide better logging and audit capabilities for compliance requirements.
For more on app development, see custom Shopify apps.
Working with LiftKit Digital
LiftKit Digital builds custom apps for clients with specific requirements. We also advise on when public app development makes sense.
To discuss your app requirements, get in touch.