Shopify App Template

The challenge

Every new Shopify app starts with the same work: authentication, webhooks, background jobs, GDPR compliance, billing and an admin UI. Done ad hoc for each app, every one ends up slightly different, and the hard-won fixes from one app never reach the next.

The approach

1. 01One command to start: an interactive setup finds a free port, generates the database password and encryption key, writes the environment, starts PostgreSQL in Docker and runs the migrations.
2. 02Three API surfaces, each with its own guard: admin routes verify App Bridge session tokens, storefront routes verify App Proxy signatures, and webhook routes check the HMAC and drop duplicate deliveries before any work is queued.
3. 03Background work on BullMQ with a typed, cross-process event bus. Redis is optional: without it, webhooks are processed inline, so a new app runs locally with no extra infrastructure.
4. 04One client for Shopify's Admin API: every GraphQL operation lives in one place, codegen types each query and its variables, and throttled calls are retried using Shopify's own leaky-bucket formula.
5. 05Compliance built in: GDPR webhooks are wired up, uninstalling and deleting data are kept apart so an accidental uninstall doesn't wipe a merchant's history, and sensitive fields are encrypted with AES-256-GCM.
6. 06Ready for production: a Docker image, CI that type-checks, tests and builds before anything deploys, operational alerts with cooldowns, memory monitoring and managed billing plans.

The outcome

It is the foundation for every Shopify app Edition builds, Expansion Store Sync included, and it is maintained alongside them. New apps start on features instead of setup.

One setup command creates the database, secrets and environment. From there, a typed event bus lets any process publish events that background workers handle, with every event name and payload checked at compile time.