Timing has an outsized effect on app projects. Building against a stable business process produces a clean app; building against a process still being invented produces a change log with no releases. We scope apps in two stages for exactly this reason: a production slice that captures the rules as they stand, then a hardening pass once the process settles. Teams that skip the staging almost always pay for it twice, once in rework and once in the support tickets the rework generates.
App architecture starts with billing permissions, oddly enough. The less an app can touch, the safer you are and the faster Shopify approves changes. We scope down relentlessly: read only where writing is unnecessary, webhook scoped instead of polling, admin UI pages instead of storefront script injection. A custom app inside your own store avoids the app store review path entirely, which is why internal tooling rarely needs to be public.
Money paths get engineering discipline. Webhooks arrive with HMAC signatures, land in a queue, and process with retries and a dead letter alert, because Shopify will redeliver but your customer will not wait. Idempotency keys guard every write that can be retried. The subscription engine treats billing edge cases, card failures, plan changes mid cycle, timezone boundaries in billing dates, as first class behaviour with tests, not as support tickets waiting to happen.
Admin UIs follow Polaris, Shopify's own design system, deliberately. Your staff already live in the Shopify admin every day; an internal tool that looks and behaves like it takes zero training. We build with App Bridge so the app sits embedded in admin navigation, respects staff permissions, and inherits your session handling. The measure of a good internal tool is that nobody schedules a meeting to explain it.
Ownership is the point of custom apps, so handover is engineered in. The app runs in infrastructure you control, commonly Cloudflare Workers or a small Node service, with secrets in your vault and billing in your accounts. Documentation covers the data model and the failure modes. At launch your developers get a recorded walkthrough and the runbook. If we disappear the next day, the app keeps running and any competent Shopify team can pick it up.