shopify-prod-checklist

name	shopify-prod-checklist
description	Execute Shopify app production deployment checklist covering App Store requirements, mandatory webhooks, API versioning, and rollback procedures. Use when preparing a Shopify app for production launch, submitting to the App Store, or auditing an existing deployment for compliance gaps. Trigger with phrases like "shopify production", "deploy shopify", "shopify go-live", "shopify launch checklist", "shopify app store submit".
allowed-tools	Read, Bash(curl:*), Grep
version	2.7.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","ecommerce","shopify"]
compatibility	Designed for Claude Code

Shopify Production Checklist

Overview

Complete pre-launch checklist for deploying Shopify apps to production and submitting to the Shopify App Store.

Prerequisites

• Staging environment tested and verified
• Shopify Partner account with app configured
• All development and staging tests passing

Instructions

Step 1: API and Authentication

• Using a recent stable API version (e.g., 2025-04), not unstable
• Access token stored in secure environment variables (never in code)
• API secret stored securely for webhook HMAC verification
• OAuth flow tested with a fresh install on a clean dev store
• Session persistence implemented (database or Redis, not in-memory)
• Token refresh/re-auth handled for expired sessions
• APP_UNINSTALLED webhook handler cleans up sessions

Step 2: Mandatory GDPR Compliance

• customers/data_request webhook handler implemented
• customers/redact webhook handler implemented
• shop/redact webhook handler implemented (fires 48h after uninstall)
• All three configured in shopify.app.toml
• Handlers respond with HTTP 200 within 5 seconds
• Customer data deletion actually works (test it!)

Step 3: Webhook Security

• All webhooks verify X-Shopify-Hmac-Sha256 using HMAC-SHA256
• Using crypto.timingSafeEqual() for signature comparison
• Webhook endpoints use raw body parsing (not JSON middleware)