Private Shopify Apps

If you still have a private Shopify app, you have an app nobody has looked at since 2023 holding live credentials to your store. We find it, audit what it can reach, and help you decide what it should become.

Start a project All services

One store, one internal tool, and the shortest possible scope listPRD · 03

Overview

The app you inherited, and what it can still reach

Shopify stopped allowing new private apps in January 2022 and, on 20 January 2023, automatically converted every one that still existed into a custom app. Nobody had to do anything, which is the problem: the conversion was silent, so a great many stores are running an app that still works, still holds Admin API access, and has not been opened by anyone since.

That app is usually the oldest integration in the business and the least documented. It often carries scopes granted years ago for a reason nobody remembers, credentials that have never been rotated, and a dependency that half the team does not know exists. This engagement is about finding it and deciding what it should be — not about rebuilding it by reflex.

You find out what you have: Which app your private app became, where it lives, who owns the Partner account, and what still depends on it.
Scopes stop being a guess: Access granted years ago gets reviewed against what the app actually does, and anything it no longer needs is dropped.
A decision, not a rebuild: Keep it, fold it into an app you already run, or replace it with an integration — chosen on evidence rather than by default.

Discuss your project

App topology

An embedded app sits between the merchant's admin and their data — and has to behave in both directions.

InstallReadReactBill

Shopify Admin

App Bridge
Polaris
session token

Your app

OAuth
webhooks
billing API
background jobs

GraphQL Admin API

products
orders
metafields
bulk operations

The merchant installs from the admin. OAuth grants the scopes the app asked for, and nothing outside them is reachable afterwards.

The embedded app authenticates each request with a session token and reads through the GraphQL Admin API — never a stored password, never a scraped page.

Webhooks push changes back the other way, so the app reacts to what happens in the store instead of polling it.

Charges go through Shopify's billing API, so the merchant pays on their existing Shopify invoice and the app never handles a card.

What's included

What the engagement covers

Locating the converted app in the Partner Dashboard
Access scope audit against actual usage
Credential and access token rotation
Inventory of systems and jobs that depend on it
API version and deprecation exposure check
A written keep / replace / retire recommendation

Technologies

Node.js
GraphQL Admin API
Webhooks
REST
PostgreSQL
TypeScript

Use cases

Where this helps most

Nobody knows what it does
An app that has run since before anyone currently on the team joined, with no documentation and no named owner.
A security review asked
Someone needs a list of what has API access to the store, and the honest answer is currently unknown.
It finally broke
An API version was retired and the integration stopped. The decision now is whether to revive it or replace it.

Process

How we deliver

Find it
We locate the app in the Partner Dashboard and the store's app list, and establish who owns the account it belongs to.
Audit it
What scopes it holds, what it actually calls, which API version it targets, and what breaks if it stops.
Decide
Keep, fold into an existing app, or replace with an integration — written down with the reasoning, not just the verdict.
Execute safely
Rotate credentials, drop unused scopes, and carry out the chosen path without interrupting what depends on it.

FAQ

Private Shopify Apps

How do I find the app my private app became?

It is in the Partner Dashboard of whichever account created it, listed as a custom app, and it also appears in the store's installed apps. The hard part is usually not the app but the account — original private apps were often created by a developer or agency who has since moved on, and recovering ownership is frequently the first task.

So is a private app just a custom app now?

Yes. Shopify deprecated private apps in January 2022 and, on 20 January 2023, converted every one that still existed into a custom app. If you are searching for a private app developer, a custom app is what you are looking for — the same single-store tool under the name Shopify now uses.

It still works. Why touch it?

Because it holds live API access nobody has reviewed, and because Shopify supports each API version for a year. An unmaintained app does not degrade — it works until a version is retired, then stops. Knowing which version it targets tells you roughly when that happens.

What if the answer is that we should rebuild it?

Then we say so, and that is <a href="/services/custom-shopify-apps">custom app work</a> rather than this. The point of the audit is that the decision is made on what the app actually does, which is usually less than everyone assumes.

Proof

Where we have done this

Real projects that used this capability. Every one shipped.

Shopify StorefrontsProduction

Canvas Lab

EcomLabs contributed theme engineering, checkout work, and CRO to this Shopify storefront, supported by private Node.js applications and API integrations.