Skip to main content

Documentation Index

Fetch the complete documentation index at: https://help.the-meridian.ai/llms.txt

Use this file to discover all available pages before exploring further.

Meridian’s submission tool runs a comprehensive pre-flight check across your app before you submit it to the Shopify App Store for review. It surfaces issues Shopify reviewers commonly flag — from missing compliance webhooks and outdated API versions to listing quality problems — giving you a clear score and a prioritized action list before you ever click Submit for review in the Partner Dashboard.

​
How the submission checker works

Open App Store → Submission in your Meridian dashboard to run a check. Meridian evaluates your app across eight categories and produces a ReviewReport with:
  • A readiness score from 0–100
  • A readiness status: ready, needs-work, or not-ready
  • An estimated Shopify review time based on open issues
  • Per-check results with status, severity, and fix suggestions
  • AI-powered insights that predict rejection risk and highlight patterns Shopify reviewers flag most often
The checker runs client-side against your app’s configuration and known patterns. For the most accurate results, make sure your app URL, Partner Dashboard settings, and API scopes are up to date in Meridian.

​
Reading your results

Each check has a status and a severity.

​
Check status

StatusMeaning
passNo issues found. This check is clear.
warningA potential concern. Not a guaranteed blocker, but worth fixing before submission.
failAn issue was detected. Shopify reviewers are likely to flag this.
pendingThe check has not run yet.
runningThe check is currently executing.
skippedThe check does not apply to your app’s configuration.

​
Check severity

SeverityWhat it means
criticalShopify will reject your app. Fix before submitting.
highLikely to cause rejection or significant delay in review.
mediumMay slow down review or affect merchant trust.
lowMinor improvement that won’t block submission.
infoInformational only — no action required.
Any critical failure sets your readiness to not-ready. You must resolve all critical failures before submitting. Submitting with known critical issues will result in rejection and resets your review queue position.

​
Check categories

Meridian organizes all checks into eight categories. Expand each one to see what’s covered.
Covers the OAuth flow, session tokens, and install/uninstall lifecycle.Critical checks:
  • OAuth fires immediately when a merchant clicks Install
  • Merchants are redirected to your embedded app UI after install (not a blank or error page)
  • Your app uses Shopify session tokens for authentication — not third-party cookies
High severity checks:
  • Uninstall and reinstall cycle works cleanly without stale data
  • Your app requests only the API scopes it actually uses — excessive scopes trigger rejection
Medium severity:
  • Merchants can authenticate using their Shopify identity without creating a separate account
Covers API usage, App Bridge version, billing, and error handling.Critical checks:
  • Your app uses the latest version of Shopify App Bridge (older versions will be rejected after July 1, 2025)
  • All charges go through the Shopify Billing API — external payment collection is not permitted
  • Your app does not bypass Shopify checkout
High severity checks:
  • Your app uses a current, non-deprecated Shopify API version
  • API errors, rate limits, and network failures are handled gracefully
  • Your app handles 429 responses with retry logic and exponential backoff
Medium severity:
  • Webhook endpoints return 2xx quickly and handle retries and duplicates
  • Your app uses the App Bridge Save Bar API for save actions in the admin
Covers mandatory GDPR webhooks, privacy policy, and data handling.Critical checks:
  • customers/data_request webhook is registered and responds within 5 seconds
  • customers/redact webhook is registered
  • shop/redact webhook is registered
  • A privacy policy disclosing data collection, usage, retention, and international storage is published and linked
High severity checks:
  • Your app only collects data that is strictly necessary for core functionality
  • If you access PII (name, address, phone, email), your app has approved protected scopes
  • Your app complies with GDPR data processing requirements
Missing compliance webhooks are the single most common cause of immediate rejection. Register all three (customers/data_request, customers/redact, shop/redact) before submitting.
Covers app naming, navigation patterns, and merchant experience consistency.Critical checks:
  • Your app name does not contain “Shopify” or any abbreviation of it
  • Your app’s domain does not contain “Shopify” or “Example”
High severity checks:
  • Critical features like login and payment do not use pop-up windows
  • Your app uses tabs (not custom navigation components) for secondary navigation in the admin
  • Your app listing uses factual information only — no fake reviews or inflated claims
Medium severity:
  • What your app does is clearly communicated before a merchant installs it
  • Your UI matches Shopify admin patterns for a consistent merchant experience
  • Subscription costs, billing cycles, and included features are clearly stated
Covers your Partner Dashboard listing configuration.Critical checks:
  • App icon is exactly 1200×1200 pixels in JPEG or PNG format
  • An emergency email and phone number are on file in your Partner Dashboard
High severity checks:
  • API contact details are provided for Shopify to reach you about API issues
  • Your app description clearly explains the value, features, and target audience
  • Screenshots are included and accurately show key app features
  • Your app is not labeled as beta or described as having “coming soon” features
  • Your app is not a duplicate of an existing listing
  • App URL, redirect URLs, and GDPR URLs are correctly configured
Covers HTTPS, HMAC validation, token storage, and input sanitization.Critical checks:
  • Every URL and endpoint your app exposes uses HTTPS
  • All incoming webhooks are validated using HMAC to verify they originate from Shopify
  • Shopify access tokens are stored encrypted and never exposed in client-side code
  • No API keys, secrets, or tokens appear in frontend or client-side code
High severity checks:
  • Content Security Policy headers are set to prevent XSS and injection attacks
  • All user inputs are validated and sanitized server-side
Covers Core Web Vitals, checkout extension speed, and Lighthouse impact.Critical checks:
  • Admin Cumulative Layout Shift (CLS) ≤ 0.1 at the 75th percentile
  • Admin Interaction to Next Paint (INP) ≤ 200ms at the 75th percentile
  • Checkout extension P95 response time ≤ 500ms
  • Checkout extension failure rate ≤ 0.1%
High severity checks:
  • Your app does not reduce the storefront Lighthouse performance score by more than 10 points
  • The embedded app UI loads within 3 seconds on a standard connection
If your admin CLS ≤ 0.1 and INP ≤ 200ms, and you reach 50+ net installs, you qualify for the Built for Shopify badge.
AI-powered checks that go beyond static rules to predict rejection risk and surface patterns from historical submissions.
CheckWhat it looks for
Code pattern analysisAnti-patterns, deprecated API usage, and known review blockers in your codebase
Listing quality scoreYour description, screenshots, and metadata benchmarked against top-performing apps in your category
UX pattern reviewYour UI patterns compared against Shopify Polaris design guidelines
Security vulnerability scanExposed secrets, insecure configurations, and common vulnerabilities
Privacy compliance assessmentData handling patterns and GDPR completeness
Rejection risk predictionLikelihood of rejection based on patterns from past submissions, with a confidence score
Each AI insight includes a list of concrete actionItems and a confidence score (0–1) so you can prioritize the highest-confidence findings first.

​
The Shopify review process

Understanding what happens after you submit helps you prepare effectively.
1

Submit from the Partner Dashboard

Once your app passes Meridian’s pre-submission checks, submit it from your Shopify Partner Dashboard. Shopify’s review queue is typically 2–5 business days for new apps.
2

Automated checks run first

Shopify runs automated checks before assigning a human reviewer. These cover many of the same categories Meridian checks — performance thresholds, HTTPS, required webhooks, and API version compliance.
3

Manual review

A Shopify reviewer installs your app, tests the merchant experience, and evaluates your listing against the App Store requirements. They pay close attention to billing flow, UX patterns, and listing accuracy.
4

Decision

Shopify either approves your app, or sends feedback with required changes. If your app is rejected, fix the flagged issues and resubmit. Each resubmission joins the review queue again, so addressing all issues at once reduces turnaround time.

​
Common rejection reasons and how to avoid them

Rejection reasonHow to avoid it
Missing GDPR compliance webhooksRegister customers/data_request, customers/redact, and shop/redact before submitting
Outdated App Bridge versionUpgrade to the latest @shopify/app-bridge package and replace deprecated navigation actions
Excessive API scopesAudit each requested scope against actual feature usage and remove any that aren’t needed
External payment collectionRoute all charges through the Shopify Billing API
Performance thresholds not metMeasure admin CLS and INP in production; optimize before submitting
Incomplete or misleading listingUse factual language, accurate screenshots, and a complete description
Missing or inadequate privacy policyPublish a policy that covers data collection, usage, retention, and cross-border storage

​
Tips for a successful submission

Fix all critical failures before addressing high or medium severity warnings. Shopify’s automated checks will block your submission on critical issues regardless of how polished your listing is.
  • Test the full install → billing → uninstall → reinstall cycle before submitting. This is the most common source of rejection issues that slipped through development.
  • Test in a real development store — not just your local environment. Shopify reviewers install from the App Store listing, so the experience they see must match what you tested.
  • Write your listing for merchants, not developers. Lead with the problem you solve, not the technology you use. Shopify reviewers evaluate whether a merchant can understand what your app does before installing it.
  • Respond promptly to reviewer feedback. If Shopify sends change requests, resubmit within a few days to keep the context fresh and avoid additional delays.
  • Keep your API version current. Deprecated API versions are caught by automated checks. Check the Shopify API Alerts page in Meridian to stay ahead of deprecation deadlines.
  • Shopify API Alerts — get notified when Shopify deprecates an API or announces a breaking change that affects your app
Last modified on May 5, 2026