[Feature Request]: Include a partner-supplied attribution parameter in the review notification email

Summary

When a review is published, Shopify emails the partner account with the rating, review text, shop, and timestamp, nothing that identifies where the review came from. Partners who ask merchants for reviews can’t connect a review to the request that earned it.

The request

Echo an attribution parameter back in the review notification email. Two halves of one change, neither is useful alone. Shopify already supports UTM parameters on listing links for attributed installs. This extends an established pattern to reviews.

a. Return the value in the notification email. Shopify already sends it. One additional field is the smallest change that fully solves this. No new API surface, no new UI, no polling. It turns our probabilistic matcher into a direct lookup.

b. Preserve a server-visible parameter on the deep link, so there’s something to return. Accept the standard UTM set, or a single reserved parameter, or even let us specify our own. Persist it onto the review record:

https://apps.shopify.com/<app-handle>?ref=<opaque-id>#modal-show=WriteReviewModal

Two constraints worth stating. It must be a query parameter, not part of the fragment, everything after `#` is client-side only and never reaches the server, so an id appended to #modal-show=WriteReviewModal can’t be captured. And the value can be fully opaque: stored and echoed, never parsed, validated, or interpreted.

What’s missing today

As far as we can tell:

  • The notification email carries no attribution or referral field (see above).
  • Query parameters on the listing URL aren’t carried through the `#modal-show=WriteReviewModal` flow in any way a partner can later observe.

Why the shop name doesn’t close this. The email identifies the store by display name. A label merchants can change at any time, and one that isn’t unique across the App Store. But even a stable identifier like the myshopify.com domain wouldn’t be enough. It tells us which store left the review, not which request prompted it. Any merchant we’ve asked more than once (a different conversation, a different month, a different person on our team) remains ambiguous. Store identity narrows the candidate set. Only a value we supplied ourselves resolves it.

Why it matters

Today the path ends in a guess. One preserved parameter makes it end in a fact.

We can see a request go out, to which merchant, from which team member, then the trail stops… The review appears some indeterminate time later with nothing tying it back.

So we infer. We built a probabilistic matcher that scores candidate requests against each new review and emits a confidence score. It works, but delayed reviews, multiple outstanding requests to the same merchant on different surfaces, and merchants who review from a different context than the one they were asked in all degrade it. That’s a lot of infrastructure to reconstruct one value that exists at submission time and is then discarded.

The real cost isn’t reporting. Asks are sent by our support team inside real conversations, so if we can’t tell which ones convert, we can’t learn, and we can’t coach team members from real examples. The asks never improve, the merchant’s experience during the ask stays sub-par. Attribution means sending fewer and better-targeted asks, not more.

Also useful, not required

Neither of these is the ask, but both would help:

  • The same value surfaced as a “Source” column in the Partner Dashboard review list, the CSV export, and the Partner API.
  • A read endpoint on the Review API, which today only requests a review modal in-app. Fetching a review by the parameter above would remove the need to parse notification emails entirely.
  • A review.created webhook. Useful independently of everything above, and it would remove the need to parse notification emails at all.

Scope

This asks for nothing about reviewer identity, and gives us no ability to gate, filter, or condition a review on the value. It’s a random id (12345) that means nothing to anyone but us. It appears in the merchant’s URL bar, as any query parameter does, but reveals nothing, and never needs to be rendered back into the listing page or the review itself. A length cap would be entirely reasonable.

Nothing here changes what merchants can write, or how reviews are moderated.

Hey @Pierre_Gravelle - thanks for the detailed write-up.

I’ve shared your feedback with the relevant team, including the need for a partner-supplied value to persist through the review flow and return in the notification, rather than relying on shop information alone. No guarantees, but I’ll follow up here if anything changes on this front.

Thanks again for taking the time to lay out the use case so thoroughly.

Hey @Wes-Dev-Shopify , you’re welcome. And thanks for the response and for sending this to the team! :slight_smile:

Let me know if there’s anything else I can do to help drive this forward and keep it active. More than happy to talk with someone about this in detail.

Hey @Wes-Dev-Shopify, just wanted to see if there was any movement on this in your feature-request queue/inbox! :slight_smile: Would appreciate an update, thanks!

I’m deeply against this because it will enable apps to find new ways to game the system, or incentivize them to give financial rewards to customer support agents who trigger a review.

I even think any review that says something as “Mr. X was really helpful” sound really suspicious and should be investigated.

Hi @David_Arbias! Two points I want to address here.

“Incentivization” and “Gaming the system”

Incentivizing merchants for reviews is what breaches the partner agreement. For example, saying
“Hey, write a review and earn a $50 amazon gift card”

Internal incentives for review generation is something entirely different, as long as it’s not mentioned in the ask itself:

:white_check_mark: “If you’d like to leave app a review, here’s a link!”
:x: “If you leave app a review, it’d really help me personally, and gets me a $50 gift card!”

I don’t see how attribution leads to gaming the system, but if you can help connect the dots it’d allow me to address your concerns directly idea! :slight_smile:

Scope (again)

Re-iterating my Scope comment below:

Nothing here changes what merchants can write, or how reviews are moderated.

AKA: Writing reviews, the current ways reviews are requested, and the partner guidelines around reviews do not change. This only introduces an attribution layer.

There’s more use cases here than just internal incentives too:

  1. Best Experience Phrasing: Attribution helps discover which (compliant and neutral) scripts or closing lines give the best closing experience. Rather than having the ask contaminate their experience.
  2. Pinpointing the Right Timing: Finding out exactly when successful agents ask for reviews (e.g., immediately after fixing a critical bug vs during a routine health check).
  3. Fair Workload Distribution: Tracking attribution highlights if certain agents are naturally great at building rapport. Allowing us to balance the team so more technical agents handle code/troubleshooting, while relationship-builders handle merchant onboarding, billing concerns, and other sensitive conversations.
  4. Shopify AND Internal Monitoring: If Shopify ever flags a sudden spike in an app’s reviews, having a clear internal attribution log allows us to prove these reviews came from real and compliant interactions. And also allows us to audit the specific interactions involved to ensure there were absolutely no coercive or non-compliant tactics used. Without attribution, we’d have no clue which interactions to internally audit in response.
  5. More. Yes, there’s tons more. I can definitely give you more if you need them.

Hey @Pierre_Gravelle - thanks for checking back in. I don’t have a new update or timeline to share since my last reply. The request and the use case you’ve outlined are still captured, including the additional context shared here.

This remains a feature request, so I can’t confirm whether or when the proposed changes will be implemented.

The concern raised about possible misuse is useful context, but I don’t have information indicating that it changes the request’s status. Shopify’s published requirements prohibit incentivizing merchants or asking specifically for positive reviews, and recommend using neutral language: Manage app reviews in the Shopify App Store. The published guidance doesn’t address internal attribution, so I don’t want to interpret the policy beyond what’s documented.

If anything changes on this front, I’ll update the thread. Hope this helps!

Here’s how attributation leads to gaming the system:

Hoppy pop up apps has 217 reviews, (most of them probably incentivized).

They achieved this using incentivized reviews and nothing was done.

If you give them attributing metrics, they may learn that changing the headline to “Save $100 by leaving an app review” will increase 5 star reviews by 35% and so on.
More details here:

Another example:

Kedra checkout rules has right now 503 app reviews (most of them probably incentivzed).

They were found using this banner, and nothing was done:

If you give them attributing metrics, they may learn that placing that banner inside a chat with an agent might increse 5 star reviews by 59%.

More details here:

Yes they can already code an attribution system without Shopify help, however, if Shopify adds this attribute, any app will be able to do this with 0 skill and much more precision.

TLDR:

This tool will benefit dishonest apps much more than honest apps.

Hi @David_Arbias , thanks for laying it out. That’s exactly what I was asking for and it helps me see what you meant.

No argument on the banners themselves. Offering free or discounted access in exchange for a review is the specific thing the policy prohibits. The frustration is fair too. Competing against inflated review counts is a real problem, and I’d rather see it dealt with than not. I’ll hop onto that thread you sent and share my support.

Where I disagree is that attribution is what makes that playbook work.

An app showing a banner to every merchant already owns the surface and controls the variant. It doesn’t need per-review attribution to optimize it. Swap the headline, watch the weekly review count and the average rating move, there’s your answer. At a few hundred reviews flowing through one automated surface, aggregates are a perfectly good instrument.

On the skill point specifically: measuring a banner shown to everyone was never the hard part. One surface, one variant at a time, one number to watch. That floor is already on the ground.

Per-request attribution earns its keep in the opposite situation. Low volume, every ask inside a human conversation that can’t be re-run, nowhere near enough events for aggregate numbers to mean anything. That’s the case I’m making it for.

Appreciate you pushing on this either way.

Thanks @Wes-Dev-Shopify! Completely understand that there’s tons of feature requests out there, so it’s hard to prioritize. I’d like to speak on the value to Shopify, since I’ve mostly framed this from the partner side.

A partner-supplied value on the review record isn’t only useful to the partner who set it. It gives an investigation something to reconcile against. If a partner’s review pattern gets flagged, one whose attribution log lines up with the review record is quick to clear, and one who can’t produce anything is where the time is better spent. It doesn’t catch anyone on its own, since it’s opt-in by nature. It just makes the honest cases cheap to close.

Related, the webhook and read endpoint I mentioned would also mean partners stop parsing the notification email to get this data. Right now that email format is effectively an API that can’t change without breaking things downstream.

I framed the original problem too broadly, so here’s a narrower version in case it’s more useful to whoever has it.

A review email comes in and it’s from “Store A”. That’s the gap: we can’t tell who Store A is.
Is it store-a.myshopify.com? Or is it abcd12345.myshopify.com?

Wait A Minute, Who Are You? - Iconic Kid Meme

Today the notification identifies the store by display name only, which isn’t a stable identifier: names collide, and merchants change them. Including the store’s .myshopify.com domain would solve most of the problem on its own, and there’s nothing for a partner to game, because the value would be Shopify’s rather than our own.

That’s the smaller ask. Attribution down to who sent a given request is a nice-to-have. Unambiguous store identity is the actual gap, and it’s the part that’s currently guesswork.