Shopify App Development AI Skill Guide (Claude)

Overview & Engine Architecture

Shopify apps extend merchant admin and storefronts. Embedded apps authenticate with session tokens (App Bridge); backends call Admin GraphQL with shop-scoped offline access tokens (X-Shopify-Access-Token). Shopify pushes events over webhooks that must be HMAC-verified on the raw body. Agents treat shop query params as untrusted until token/HMAC validation succeeds, pin Admin API versions, budget GraphQL query cost, and purge tokens on app/uninstalled.