Shopify App Store

Shopify App Store
,
1

**Partner Dashboard not verifying GDPR compliance webhooks before app submission
**
Hi Team,

I have implemented all mandatory GDPR webhooks
(CUSTOMERS_DATA_REQUEST, CUSTOMERS_REDACT, SHOP_REDACT)
using the Admin GraphQL API.

Details:

  • Webhooks registered successfully and confirmed in logs
  • Endpoint returns HTTP 200
  • HMAC SHA256 verification implemented as per Shopify docs
  • Using stable API version 2024-07
  • Non-GDPR webhooks are verified correctly

However, in Partner Dashboard → Automated checks, the following remain red:

  • Provides mandatory compliance webhooks
  • Verifies webhooks with HMAC signatures

Shopify Support confirmed this requires manual validation by the App Review team.
Posting here to confirm if this is expected behavior before submission.

Thanks.

3

Hi @Rishi_Malhotra,

For us to be able to look into specific examples of apps failing the App Store Review Preliminary steps, we would need you to login to the Shopify Help Center and reach out to Shopify Support Directly, so we can authenticate you with the partner account, and look into the specific app in question.

First of all, I just wanted to confirm as well that what you were told is incorrect, as these errors you experienced are from automated checks, and do not require manual validation by the App Review Team.

It’s only after you pass all the automated “Preliminary steps” checks, including Mandatory Webhook Subscription and HMAC Validation, and submit the actual app review, that the App Store Review team will manually review and approve or deny the application.

That said, if your app is still failing the automatic preliminary steps for HMAC validation and compliance webhook subscription, I would recommend checking the following, as they are common causes for these to fail.

For HMAC validation, the automated tests will check how your app responds to both valid and non valid webhooks, and this often fails as the app developers usually forget to reply to webhooks that fail the HMAC validation with a 401 HTTP Response code, as well as replying to webhooks that succeed the HMAC validation with a 201 HTTP Response code

Some other common pitfalls for Webhook HMAC Validation are listed in the Shopify.dev Documentation here:

For the mandatory compliance webhook subscription, we do require that you subscribe to the webhooks via the app’s toml configuration file, as this ensure the webhooks are subscribed with the app installation. If you are subscribing to the mandatory webhooks via an API call after the app is installed, then it will fail the checks.

More information on subscribing to the mandatory compliance webhooks here:

If you are still seeing the automated checks failing after reviewing the information I shared above, please do reach out to our Shopify Help Center, and our Support Team can help you look into this further with a specific app.