How to Build a Custom Shopify App in 2026: APIs, Dev Dashboard and Best Practices

Every growing Shopify store eventually runs into a problem the App Store cannot solve. Maybe it is a pricing structure too specific for any off-the-shelf app to handle. Maybe it is an ERP that needs to talk to Shopify in a way no plugin was built for. Or a checkout flow so tied to how the business operates that no existing solution comes close. When that moment arrives, building a custom Shopify app becomes the answer worth taking seriously.

The process of Shopify app development in 2026 is more defined than it used to be, but it has also changed enough that following older tutorials will lead you somewhere broken. Since January 2026, all new custom apps go through the Shopify Dev Dashboard rather than the legacy admin flow. The Admin GraphQL API is now the standard for reading and writing store data, with REST officially in maintenance mode. Shopify Scripts stopped executing on June 30, 2026. Anyone building on the 2022 stack without knowing this is working from a foundation that no longer holds.

This guide covers how Shopify app development actually works today. You will find the current tool stack, how to register your app in the Dev Dashboard, how authentication and OAuth work, how to handle webhooks reliably, which extension types are available in 2026, and the mistakes that derail most builds before launch.

Key Highlights

• All new custom Shopify apps must be registered through the Dev Dashboard since January 2026. The legacy admin method no longer applies to new builds
• The Admin GraphQL API is the standard for Shopify app development now. REST exists for older integrations but receives no new features
• Remix with React Router is Shopify's recommended framework for embedded apps, and the CLI scaffolds a working project in under five minutes
• Webhooks are not optional. GDPR handlers and APP_UNINSTALLED are mandatory for public app submissions
• App extensions let your build reach the storefront, checkout, and POS without touching theme code directly

What a Custom Shopify App Actually Is

A custom Shopify app is code that connects to a store through Shopify's official APIs rather than through a pre-built solution from the App Store. It can read and write store data, listen for events and react to them in real time, embed a full interface inside the Shopify Admin, extend the checkout experience, or act as a bridge between Shopify and the external systems a business already depends on.

When people talk about Shopify app development, they usually mean one of two things:

• Single-store custom apps: Built for one specific merchant through the Dev Dashboard. No App Store review, no public listing. These are the right choice for internal tools, proprietary workflows, and business-specific automation that would not make sense as a public product.
• Public apps for multiple stores: Built to be installed by any Shopify merchant. These require a Shopify Partner account, App Store review, GDPR webhook handling, and a billing setup. The right path when you are creating a product for the wider ecosystem.

Most businesses exploring custom Shopify app development are after the first type. A purpose-built solution shaped entirely around their store, their data, and their specific process gaps. That is the focus of this guide.

The Shopify App Development Stack in 2026

If the last time you looked at how to build a Shopify app was in 2022 or early 2024, the recommended stack has changed enough that some of what you remember no longer applies. Here is what actually makes up a modern Shopify app build today.

The Shopify Dev Dashboard

The Dev Dashboard is where every new custom app starts. It replaced the old way of creating custom apps inside the Shopify Admin, which stopped working for new builds on January 1, 2026. This is where you register the app, name it, set the API scopes it needs, create versioned releases, and get your access credentials. Existing apps built before that date continue to work, but any new Shopify app development begins here.

To reach it: open the Shopify Admin, go to Settings, click Apps, then choose Develop apps and select Build apps using Dev Dashboard.

The Admin GraphQL API

The Admin GraphQL API is the primary interface for reading and writing store data in any new Shopify app build. Products, orders, customers, inventory, fulfillments, metafields, all of it goes through GraphQL. The practical advantage over REST is that a single query returns exactly the fields you ask for, which reduces unnecessary data transfer and API call volume. Shopify is investing all new features into GraphQL and has placed the REST Admin API into maintenance mode. Starting a new Shopify API integration on REST creates technical debt from day one.

A basic product query looks like this: { products(first: 10) { edges { node { id title totalInventory } } } }. That runs against the GraphQL endpoint with your access token in the header and returns exactly what you asked for, nothing more.

Shopify CLI

The Shopify CLI is the command-line tool that handles everything from project setup to deployment. Running npm init @shopify/app@latest generates a complete starting point with authentication, routing, Polaris, and App Bridge already configured. You are working on actual features from session one rather than building the plumbing yourself.

Remix with React Router

Remix, now built on React Router, is Shopify's recommended framework for building embedded Shopify apps. It handles server-side rendering, routing, form submissions, and data loading in a pattern that fits naturally with how Shopify apps operate. The CLI-generated template comes pre-wired with OAuth, session management, and Polaris so the entire foundation is ready on the first run.

Polaris

Polaris is Shopify's UI component library. Any app that embeds inside the Shopify Admin should use it. The components cover page layouts, data tables, form inputs, banners, resource lists, and everything else needed for a complete admin interface. For public apps, Polaris is a requirement during App Store review. For private builds, it is simply the fastest way to produce a UI that feels native rather than out of place.

Webhooks

Webhooks let your app react to store events the moment they happen rather than polling the API to check for changes. An order placed, inventory updated, a product changed, a customer created, your app's logic fires immediately. For any public Shopify app submission, four specific webhooks are required. Missing them gets the submission rejected.

Setting Up Your App in the Dev Dashboard

Before writing any application code, getting the app registered and the credentials ready removes the most common early blocker. The registration process itself takes around ten minutes.

1. Open Shopify Admin and go to Settings, then Apps
2. Click Develop apps and select Build apps using Dev Dashboard
3. In the Dev Dashboard, click Create app and give it a clear, descriptive name
4. Configure API scopes. Request only what the app genuinely needs. Over-scoping is a red flag during App Store review and unnecessary security exposure in production
5. Create a version and release it. The Admin API access token is generated at this step. It appears only once, so copy it immediately
6. Install the app on your development store to begin local testing

One thing worth knowing: collaborators cannot access the Dev Dashboard because it requires organization-level permissions. Only store owners and staff with the App development permission can work here. If you are commissioning this work externally, AmWhiz's custom Shopify app integration services cover full setup and configuration so you are not dependent on navigating this yourself.

How Authentication Works in Shopify App Development

Authentication is consistently where developers get stuck on their first Shopify app build. Understanding which flow applies to your app type before writing a line of code prevents a lot of rework.

Single-Store App Authentication

Custom apps built through the Dev Dashboard use a static access token rather than OAuth. When the app is installed, Shopify generates an Admin API access token scoped to the permissions you set during registration. That token goes into every API request header. There is no authorization screen for the merchant to complete and no token expiry to manage.

OAuth for Public Apps

Public apps use the OAuth authorization flow. When a merchant installs the app, Shopify redirects them to an authorization page where they review and approve the requested API scopes. After approval, the server receives an access token specific to that store. This token is stored against the shop domain and used for all subsequent Shopify API integration calls to that merchant's store.

The Remix template handles OAuth automatically through authenticate.admin(request). Every protected route calls this before loading any merchant data. If the session is valid, it continues. If the token has expired or the app was reinstalled, it redirects to re-authentication first.

Re-installation and Token Management

When a merchant uninstalls and reinstalls an app, the previous access token becomes invalid and a new one is issued. Apps that do not handle this will fail silently against the old token rather than fetching and storing the new one. This is one of the most common sources of production bugs in Shopify app development. Test the uninstall and reinstall flow explicitly before any live deployment.

Webhooks: Practical Guide for Shopify App Builders

A webhook is a POST request Shopify sends to a registered endpoint in your app whenever a specific store event occurs. Your app does not need to ask whether anything has changed. Shopify sends the notification the moment it does.

Common production webhooks include orders/created for order automation, inventory_levels/update for stock sync with external systems, products/update for catalog management, and customers/create for CRM pipeline triggers. Choosing the right webhooks for your use case is part of the scope work that should happen before development starts.

Writing Reliable Webhook Handlers

Webhook delivery is not guaranteed to be clean. Network timeouts, temporary server unavailability, and out-of-order delivery all happen in production. The correct pattern is to write handlers that are idempotent, meaning processing the same event twice produces the same result as processing it once. Shopify retries failed deliveries up to 19 times over 48 hours, so duplicate handling is not an edge case.

Verify the HMAC signature on every incoming webhook before processing the payload. Shopify includes this signature in the request header and it is validated against your app secret. Processing unsigned payloads exposes your endpoint to spoofed requests from anyone who knows the URL.

Required Webhooks for Any Public App

• APP_UNINSTALLED: Cleans up stored merchant data on uninstall. Required.
• CUSTOMERS_DATA_REQUEST: Responds to customer data requests under GDPR. Required.
• CUSTOMERS_REDACT: Handles customer data deletion requests. Required.
• SHOP_REDACT: Permanently removes all shop data after uninstall. Required.

A public app submission missing any of these four will be rejected. For private apps, implementing APP_UNINSTALLED is still good practice as it keeps your database from accumulating stale merchant records over time.

App Extensions: What Shopify App Builders Can Reach in 2026

Shopify app development does not have to stop at the admin panel. App extensions let your build surface functionality inside the storefront, the checkout, point of sale, and customer account pages without modifying theme files directly. This makes extensions safer to ship, easier for merchants to manage through their own settings, and more resilient to future platform changes.

Extension Types Available in 2026

• Checkout UI Extensions: Custom UI blocks inside the checkout flow. Used for upsell offers, donation options, custom input fields, and trust badges. These replaced the deprecated checkout.liquid approach, which no longer works.
• Theme App Extensions: App blocks that merchants can place in their storefront through the theme editor without touching code. Product badges, countdown timers, and review widgets are typical use cases. These replaced the old ScriptTag injection method.
• Admin UI Extensions: Custom panels and actions embedded directly in the Shopify Admin on product, order, or customer pages. Useful for bulk operations and contextual data without opening a separate embedded app page.
• Shopify Functions: Serverless logic that runs inside Shopify's infrastructure. Used for custom discount rules, shipping rate logic, and payment customizations. Shopify Functions replaced Shopify Scripts, which stopped executing on June 30, 2026.
• POS UI Extensions: Custom screens and workflows inside Shopify Point of Sale for retailers with in-store processes the default POS interface cannot cover.

Generate any extension type from the project directory using npm run shopify app generate extension and selecting the type needed. The CLI scaffolds the correct files and registers the extension in your app configuration without manual setup.

Realistic Cost and Timeline for Custom Shopify App Development

Cost estimates for custom Shopify app development vary more than most people expect before they start. Two projects that sound similar in a brief meeting can differ by weeks and significant budget once the requirements are actually written down. The single biggest factor in an accurate estimate is how clearly the scope is defined before any work begins.

• Simple Shopify API integration (3 to 6 weeks): A single data sync between Shopify and one external system. Basic webhook setup, minimal or no custom UI. Roughly $1,200 to $3,000 at standard developer rates.
• Moderate custom logic (6 to 10 weeks): Wholesale pricing tiers, custom checkout rules via Shopify Functions, multi-system sync with authentication complexity. Roughly $3,000 to $6,000.
• Complex integration (10 to 16+ weeks): ERP or POS connections, custom fulfillment workflows, multi-store management, full embedded admin UI with extensions. Roughly $6,000 to $12,000 or more.

Ongoing maintenance is the cost that consistently catches people off guard. Shopify updates its API versions quarterly and retires each version after 12 months. A custom app that is not maintained will eventually stop working when the version it depends on is retired. Budgeting 15 to 20 percent of the original build cost per year for maintenance is a reasonable baseline.

Mistakes That Cost Shopify App Builders the Most

These are the patterns that appear most often when Shopify app development projects go over budget, miss timelines, or break shortly after launch.

• Building without a clear scope. A vague brief produces a vague build. Define exactly what the app does, which store data it reads and writes, and what should happen in every edge case before a line of code is written.
• Using tools that stopped working. Shopify Scripts stopped executing June 30, 2026. checkout.liquid customization is no longer how checkout works. A developer still referencing these as active methods is behind the platform in a way that will show up in your project.
• Starting new Shopify API integration on REST. REST is in maintenance mode. GraphQL is where new features land. Building on REST today means hitting capability limits as soon as the project needs something newer.
• Skipping webhook signature verification. An unverified webhook endpoint processes any request from anyone who knows the URL. Always validate the HMAC signature before acting on a payload.
• Not testing reinstallation. Merchants uninstall and reinstall apps regularly. When they do, the old access token is invalid and a new one is issued. Apps that do not handle this break silently. Test the full reinstall flow before launch.
• Ignoring Polaris. Custom-styled admin UIs feel misplaced inside the Shopify Admin and are flagged in App Store review. Polaris is the required design system for public apps and the fastest path to a credible interface for private ones.
• Leaving maintenance out of the budget. Custom Shopify app development does not end at launch. API version changes, dependency updates, and platform shifts need ongoing attention. Setting this expectation from the start prevents the scramble when something breaks months in.

When Custom Shopify App Development Is Not the Answer

The cost of a custom build is justified when there is a genuine workflow gap that the App Store cannot fill. Before committing budget, it is worth testing that assumption honestly.

Search the App Store using multiple different phrasings rather than just the most obvious keyword. Useful apps are frequently named in ways that do not match the first search term you try. After that, contact support for the two or three closest matches and ask directly whether the app can be configured or extended to cover the specific need. A surprising number of apps are more flexible than their marketing copy suggests.

If nothing in the App Store comes close and the workflow is genuinely central to how the business operates, that is when custom Shopify app development earns its cost. At that point, get a written scope from at least two developers before agreeing to anything. Quotes for the same project vary significantly based on how well each developer understands what they are actually being asked to build.

Working With AmWhiz on Your Shopify App

AmWhiz works with businesses that have hit the limits of what the App Store can deliver. The team builds custom Shopify apps covering API integrations, ERP connections, checkout extensions, and multi-system workflows, all scoped around what the store actually needs rather than a packaged approach. See AmWhiz's full Shopify services to understand what a typical engagement looks like.

If you have a specific build in mind and want to talk through the scope before committing to anything, get in touch here. The team will tell you honestly whether a custom build is the right move or whether something existing would serve you better.

Frequently Asked Questions

What changed about building a Shopify app in 2026?

The most significant change is where apps are created. From January 1, 2026, all new custom Shopify apps are registered and managed through the Dev Dashboard. The legacy method of creating custom apps inside the Shopify Admin no longer applies to new builds. Apps created before that date continue to work, but any new Shopify app development starts in the Dev Dashboard.

Do I need a Shopify Partner account to build a custom app?

For a single-store custom app, no. You create it directly through the Dev Dashboard inside your own store admin. A Partner account is needed if you are building a public app for the App Store or if you are a developer building a Shopify app on behalf of a client store.

What is the difference between the GraphQL and REST APIs in Shopify?

The Admin GraphQL API is Shopify's primary API for new development. It lets you fetch exactly the fields you need in a single request, handles rate limits more efficiently, and receives new features first. The REST Admin API still works for existing integrations but is officially in maintenance mode with no new capabilities being added. Any new Shopify API integration should use GraphQL.

Are Shopify Scripts and checkout.liquid still usable in 2026?

No. Shopify Scripts stopped executing on June 30, 2026. checkout.liquid is no longer the accepted approach for customizing the checkout. Custom checkout logic now runs through Shopify Functions, and checkout UI changes use Checkout UI Extensions. A developer still describing these older tools as current is behind the platform.

How long does it take to build a custom Shopify app?

It depends almost entirely on complexity and how clearly the scope is written before development starts. A simple single-purpose Shopify API integration takes 3 to 6 weeks. A moderate build with custom logic and embedded UI typically runs 6 to 10 weeks. Complex ERP integrations or multi-surface apps with extensions take 10 to 16 weeks or more. Vague scope is the primary reason timelines extend past estimates.

What should I budget for ongoing maintenance?

A fair baseline is 15 to 20 percent of the original build cost per year. Shopify releases API version updates quarterly and retires each version after 12 months. A custom Shopify app that is not regularly maintained will stop working when the API version it depends on is retired. This is not hypothetical, it runs on a published schedule.

Can AmWhiz build a custom Shopify app for my store?

Yes. AmWhiz builds custom Shopify apps for businesses that need something beyond what the App Store provides. Share what the build needs to do and the team will advise on whether a custom app is the right path or whether an existing solution covers it.