Shopify · api · fg-0325

App Store review rejects the app over the mandatory compliance webhooks it never subscribed to

App submission rejected for missing customers/data_request, customers/redact or shop/redact handling

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Every App Store app must answer the three privacy compliance topics even if it stores no personal data. They can only be configured in shopify.app.toml or the Dev Dashboard, and an invalid HMAC must get a 401.

Fix

Declare the compliance topics in shopify.app.toml, verify HMAC and return 401 on mismatch, and deploy before submitting.

Apply

[[webhooks.subscriptions]]
compliance_topics = ["customers/data_request", "customers/redact", "shop/redact"]
uri = "https://app.example.com/webhooks"

Affects: Public apps distributed through the Shopify App Store, all API versions

Sources

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp