Agent skill · marketing growth · jeremylongshore
shopify-prod-checklist
Execute Shopify app production deployment checklist covering App Store
Why this skill is useful
Adds a comprehensive checklist for Shopify app deployment that includes specific compliance and security requirements not commonly known.
What it needs
Requires curl, jq installed locally. Requires shopify account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Shopify Production Checklist Overview Complete pre-launch checklist for deploying Shopify apps to production and submitting to the Shopify App Store. Prerequisites Staging environment tested and verified Shopify Partner account with app configured All development and staging tests passing Instructions Step 1: API and Authentication [ ] Using a recent stable API version (e.g., 2025-04), not unstable [ ] Access token stored in secure environment variables (never in code) [ ] API secret stored securely for webhook HMAC verification [ ] OAuth flow tested with a fresh install on a clean dev store [ ] Session persistence implemented (database or Redis, not in-memory) [ ] Token refresh/re-auth handled for expired sessions [ ] APPUNINSTALLED webhook handler cleans up sessions Step 2: Mandatory GDPR Compliance [ ] customers/datarequest webhook handler implemented [ ] customers/redact webhook handler implemented [ ] shop/redact webhook handler implemented (fires 48h after uninstall) [ ] All three configured in shopify.app.toml [ ] Handlers respond with HTTP 200 within 5 seconds [ ] Customer data deletion actually works (test it!) Step 3: Webhook Security [ ] All webhooks verify X-Shopify-Hmac-Sha256 using HMAC-SHA256 [ ] Using crypto.timingSafeEqual() for signature comparison [ ] Webhook endpoints use raw body parsing (not JSON middleware) [ ] Idempotency: duplicate webhook deliveries handled gracefully Step 4: Rate Limit Resilience [ ] GraphQL queries optimized (check requestedQueryCost with debug header) [ ] Retry logic with exponential backoff for 429 / THROTTLED responses [ ] Bulk operations used for large data exports instead of paginated queries [ ] No unbounded loops that could exhaust rate limits Step 5: Error Handling [ ] All GraphQL mutations check userErrors array (200 with errors!) [ ] HTTP 4xx/5xx errors caught and logged with X-Request-Id [ ] Graceful degradation when Shopify is unavailable [ ] No PII logged (customer emails, addresses, phone numbers) Step 6: Ap …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/shopify-prod-checklist--b682f1