Support app-owned, non-public (access-controlled) files on the Shopify CDN

Custom Data
1

TL;DR

  • The ask: A way for apps to store images and PDFs on Shopify’s CDN that are (a) app-owned/app-scoped (not dumped into the merchant’s Files library) and (b) not publicly accessible - retrieved via short-lived signed/authenticated URLs rather than permanent public cdn.shopify.com links.
  • The gap: Everything uploaded via fileCreate / stagedUploadsCreate lands on the CDN with a permanent, public URL and shows up in the merchant’s Files admin. There is no private tier, no signed/expiring URLs, and no app ownership.
  • Why: Apps that generate or capture sensitive artefacts (packing/proof photos, shipping labels, returns docs, generated invoices/PDFs) have nowhere on-platform to keep them privately, and are forced to use S3/GCS + signing (not ideal if we don’t want to store sensitive data).

When an app uploads a file today, fileCreate (and stagedUploadsCreate) puts it on cdn.shopify.com behind a permanent, public URL.

Three problems for app developers:

  1. Public by default. Anyone with the URL can fetch the file, and the URLs are stable, so there is no meaningful access control. Shopify’s own docs say stagedUploadsCreate “is designed to always provide a publicly accessible URL” and warn against using it for customer/client data.
  2. No signed/expiring access. There is no way to mint a short-lived authenticated URL scoped to a viewer or session, the way S3/GCS signed URLs work.
  3. Shop-owned, not app-owned. Files land in the merchant’s Files library, cluttering their admin and mixing app-internal artefacts with merchant content. There is no app-private namespace, and ownership/cleanup on uninstall is unclear.

Request:

  • A private-by-default file tier for apps, retrieved through short-lived signed URLs generated via the Admin API.
  • App-scoped ownership so these files do not appear in the merchant Files library and are cleaned up when the app is uninstalled.
  • Support for both images and PDFs (and ideally arbitrary binary), with the same async upload/fileStatus flow developers already use.

Use case:
Our app (EasyScan) is adding packing/proof photos captured at the point an order is packed. Those images can show shipping labels, addresses, and customer names, so they must be private and tied to the app - not published to a permanent public CDN URL or dropped into the merchant’s Files.

Right now the only route is running our own object storage and signing layer; a native private, app-owned CDN tier would keep the data on-platform, honour the merchant’s data-residency/compliance expectations, and remove a whole class of external infrastructure.

Would love to hear from others building fulfilment, returns, print/label, or document-generation apps who need private on-platform storage as well!

2

Thanks for raising this and for outlining the privacy concerns this creates for app developers and merchants, Charlie. I’ve submitted a feature request internally for private, app-owned storage, and we’ll update this thread if and when we have a solution to share.

In the meantime, we’d be keen to hear from other developers who need private on-platform storage and the use cases they need it for.

3

Our app allows merchants to add file upload fields to customer forms. We’ve seen merchants collecting everything from pet photos to professional or business licenses and documents. Some of these are certainly less sensitive in nature, but lots of cases where it would be preferred to have the uploaded files not publically accessible. We’ve also had a lot of merchants who, for organizational sake, don’t want all these files dumped into their shop file assets, so some sort of separation, organization, or folder structure would be huge.