Choose the boundary
Decide which product, variant and inventory identifiers will be the DPP identity. Keep that mapping explicit so a catalogue change cannot create a second public identity by accident.
- Document the source of truth
- Use stable external IDs and idempotency keys
Authenticate with least privilege
Use the current official Shopify authentication and session-token patterns. Request only the scopes needed for the selected workflow and rotate credentials through the provider controls.
- Keep app secrets outside the repository
- Record installation and uninstall events
Import, validate and surface conflicts
Bring data into a staging state, normalise it and show a conflict when the merchant value differs from a reviewed DPP value. Never overwrite silently.
- Make retries safe
- Keep an import receipt and error report
Write through owned fields
Map approved values to app-owned metafields or metaobjects. Keep source attribution and review state in DPP Grid rather than hiding them in a storefront snippet.
- Publish only approved values
- Keep private supplier evidence out of storefront output
Render an accessible storefront link
A theme-app extension can expose a passport link or safety panel without arbitrary script injection. Provide a text fallback and test keyboard, mobile and locale behaviour.