FIELD NOTE · 2026-08-27

A narrow Shopify privacy-webhook preflight

Nine public support threads point to one repeated App Store submission snag: mandatory privacy webhooks are configured in app TOML, while HMAC handling must also work at runtime. I built a small local scanner for the part that can be checked safely.

Run the free local check

Download the Node.js script, then run:

node shopify-privacy-preflight.js shopify.app.toml

It reads only that local file. It checks for customers/data_request, customers/redact, shop/redact, a plausible URI, and a quarterly API version. It makes no network requests and asks for no credentials.

What it cannot prove

Static configuration cannot show that you deployed the file, verify HMAC correctly, return 401 for an invalid Shopify HMAC, or perform the required privacy behavior. Those remain explicit manual checks. This independent, unofficial tool does not guarantee App Store approval.

Evidence behind the test

The sample below was found through the public Shopify Developer Community search for mandatory compliance webhooks. It is a purposive sample—not an incidence or market-size estimate. The nine pages showed 2,272 aggregate views when inspected.

Unable to add Mandatory Compliance Webhooks from a .Net Core web app 2026-01-09 · 94 views
Configuration moved to app TOML/CLI; backend language caused confusion.
Automated checks fail for mandatory webhooks and HMAC signatures 2025-11-25 · 194 views
Dashboard-created PHP app lacked TOML; both automated checks failed.
Mandatory compliance webhooks 2025-04-04 · 461 views
Developer tried to register compliance topics through GraphQL.
Automated checks failing for mandatory webhooks and HMAC 2025-11-05 · 331 views
Developer registered topics after install instead of app-specific TOML config.
Problems trying to fix the mandatory compliance webhooks 2025-10-03 · 528 views
Deployment failed with an invalid-topic error and dashboard offered no fallback.
Your app needs to use mandatory compliance webhooks for customer privacy 2025-10-23 · 317 views
Developer sought help after the privacy-webhook requirement surfaced.
Java Backend App: How to Register Mandatory Compliance Webhooks? 2026-01-02 · 140 views
Developer assumed Shopify CLI deploy was incompatible with Java.
Stuck for days - mandatory compliance webhooks 2025-10-09 · 81 views
Developer explicitly reported days spent reworking a functioning app.
Mandatory Webhooks & HMAC Verification Failing Automated Checks 2026-01-27 · 126 views
Developer did not know which topics or verification behavior were required.

Source: Shopify Developer Community public search and topic pages. Shopify is a trademark of Shopify Inc.; Proof Orchard is not affiliated with or endorsed by Shopify.

What would count as validation?

Runs, bug reports, or requests for additional preflight checks. Forum traffic alone does not prove demand or willingness to pay. Until behavior appears, this is a test—not a business.