I recently built a Private App to integrate my website with an existing Shopify Store - my product supplier.
However, when the Store Owner was ready to set the Permissions for my Private App as a Sales Channel, they were scared off by the abundance of warnings and negative messaging around Private Apps posted in official Shopify documentation.
"Shopify recommends asking your external developer to create a custom app."
"Consider asking your app developer to create a custom app"
"Use private apps with caution"
The end result? My product supplier backed out based on this messaging after I invested weeks building out this integration. "I have decided to pass on this unfortunately. Shopify has advised against it and it has me a bit worried." I'm now out-of-pocket $10,000s and more importantly, I've lost my supplier and likely the ability to run my business this season.
Private Apps are either legitimate or not. If it is the former, then drop all the negative messaging and stick to an objective description of pros and cons, use cases, etc. If Shopify is squarely of the opinion that this is not a solution, then remove the service entirely.
In my case, the API Key and Shopify endpoints are never even exposed in the client (all client API calls are proxied through a web server). Further, the Store owner has full control over my app permissions - which are minimal in my case.
Short story, I built a very secure application, but Shopify's negative messaging around Private Apps needlessly lost me my supplier and has now jeopardized my entire business.
Thanks for taking the time to give us some feedback. I agree that the current messaging is frustrating if you're trying to use a private app and there is no alternative available to solve the problem.
It would be helpful if we could understand a bit more about the project. Are you a partner or contractor doing work for a merchant, or do you work for the merchant directly? Am I right in thinking you are trying to use Storefront API to build a custom sales channel? Anything you can tell us about the project and what parts of the platform you were working with would be really useful at this moment for our product development research. Feel free to message me privately if you prefer.
UX for Shopify platform
Thanks for the quick reply.
I've created a custom storefront (hosted outside of Shopify) that connects to an existing Shopify store using the Storefront API.
I'm reading product data and store policies, and creating a checkout (a cart) which ultimately leads the user from my website directly to the merchants Shopify checkout page to transact. Effectively this is an affiliate type partnership; I'm trying to drive sales to another store (which uses Shopify) for a commission based on attribution. And everything is working fine. (screen cap below)
Could this be achieved using a custom app? Probably. But ultimately the store owner's decision to not partner is attributed to the language Shopify uses to describe Private Apps not the technical implementation.
"I have decided to pass on this unfortunately. Shopify has advised against it and it has me a bit worried."
When a non-technical user logs into their store to add my Private App and reads "Shopify recommends asking your external developer to create a custom app" and "Use private apps with caution" the conversation is over. All they know is "Shopify has advised against it". End of discussion. That is precisely what just happened to me. Prior to this step, the store owner was super excited to partner. As was I.
Further, I've taken many steps to secure this application: eg no Shopify endpoints or public API Keys are ever exposed in the browser - all requests are proxied through my web server. Effectively, Shopify is invisible).
How could this be prevented in the future?
Anyway, there you have it. And I'm back to the drawing board.
Despite the language around private apps, using a private app is currently the only supported method to get Storefront API credentials for a single store as you are trying to do. If it's helpful, you can refer the merchant to the developer instructions here, or the merchant instructions here, and you can assure them that private apps are the correct way to achieve this functionality at present. If the private app is setup properly with only the access it needs (e.g. only Storefront API access), there is very little risk to the merchant.
The warnings are meant more to dissuade merchants from using private apps to grant Admin API access to their store to 3rd-party developers, especially because merchants are often unaware of how much data private apps can collect once access is granted.
I understand your frustration, and I really appreciate you taking the time to give us some detailed notes. I hope we'll have better answers in this area for you soon.