How Shopify apps work

The one-sentence version

A Shopify app is your own web server that a merchant installs onto their store. Installing it gives your server an access token with limited permissions (scopes). Your server then uses that token to read and write the store's data through Shopify's APIs.

The moving parts

Part	Runs where	What it does
App server	Your hosting (Fly, Render, AWS…)	Business logic. Stores sessions and calls Shopify APIs
Embedded app UI	An iframe inside Shopify Admin	The pages a merchant sees. Built with Polaris + App Bridge
Admin API	Shopify	Products, orders, customers, metafields, billing… (GraphQL)
Webhooks	Shopify → your server	Shopify pushes events to you ("order created", "app uninstalled")
Extensions	Shopify's infrastructure	Code you upload that runs inside Shopify: storefront blocks, checkout UI, Functions

Who owns what

• Shopify hosts the store, the admin, checkout and your extensions.
• You host the app server and database. If your server is down, the embedded pages break. Extensions that don't call your server keep working.
• The merchant grants scopes at install time and can uninstall at any time. When they uninstall, you get an app/uninstalled webhook.

Kinds of apps

Type	Who can install	Listed in App Store	Typical use
Public app	Any merchant	Optional (listed or unlisted)	A product you sell, like a FlowFlex WhatsApp app
Custom app	One store or organisation	No	One-off builds for a single client

Public apps can use the Billing API and go through App Store review. Custom apps can't be listed.

The FlowFlex angle

A FlowFlex Shopify app would most likely be a public, embedded app. It would connect a store to a FlowFlex org and listen to orders/create and checkouts/* webhooks to trigger WhatsApp flows. It would charge through the Billing API.

Check yourself

1. Where does your app's UI actually run, and how does it prove who the user is?
2. If your server goes down, what still works for the merchant?
3. Why can't a custom app use App Store billing?