I’m building an app that help merchants to process COD orders faster on their website.
The app flow will be:
Customers fill in their information in the form
They click on a complete purchase button, and will be redirected to official Shopify Checkout
They double check information and complete orders
As I can understand, this process is complience with Shopify requirements.
But when I submit my app, the Shopify team still not approve our app.
Below is the reason they send us:
We’ve noticed that your app captures the customer’s information at product and cart page. This would be considered bypassing checkout. Collection of customer’s shipping and payment data must be within Shopify hosted fields not on forms. See this screencast for reference.
This point is not in the Shopify documentation, so could anybody let me know what should we do?
This is a common point of confusion during app review. The rejection is due to a core Shopify policy: all customer shipping and contact information must be collected for the first time on the official Shopify checkout pages, not on the cart or product page.
Even though your app redirects to the checkout, collecting this data beforehand is considered “bypassing” their secure and standardized process. This rule is strictly enforced for security reasons and to maintain a trustworthy experience for all shoppers.
To get your app approved, you must remove the information-gathering form from your storefront. The compliant approach is to re-architect your app using one of two methods.
The most common solution is a post-purchase flow, where your app uses the orders/create webhook to perform its logic after a COD order is placed.
Alternatively, the modern approach is to build a Checkout UI Extension, which is the only approved way to add custom functionality or fields directly inside the official checkout pages.
Thank you so much for the clear explanation!
This really helps me understand why my app was rejected and what direction I should take next. I’ll review the post-purchase flow and Checkout UI Extension options you mentioned. Appreciate your guidance!
Hi PieLab — may I ask a quick compliance question?
Our review build:
Small lead-only form on the product page (name/phone/qty), no “purchase” wording
No Admin API calls from the browser; no orders/drafts created from storefront
Backend returns popup-only confirmation (no redirect/thank-you URL)
Scopes: read_products, write_pixels, read_customer_events
Is this acceptable for app review, or must we remove any storefront lead form entirely and use only a Checkout UI Extension or a post‑purchase flow? A brief confirmation would be greatly appreciated. Thank you!
