The Shopify Remix app template: what it gives you

Shopify's CLI scaffolds new apps as Remix projects. You are not obliged to use it — an app is a web service and any stack can be one — but before rejecting it, it's worth knowing precisely what it handles, because those are the parts that are fiddly and security-relevant.

``bash npm init @shopify/app@latest ``

What it handles

The full OAuth flow. Install, callback, HMAC verification, state nonce, token exchange, token storage. Every step where a hand-rolled implementation goes subtly wrong — covered in authentication and OAuth.

Session storage. A pluggable store with an SQLite default for local development and adapters for real databases in production. Sessions are per-shop, which is exactly what a multi-tenant app needs and exactly what people get wrong writing it themselves.

Embedding and App Bridge. Correct iframe behaviour, session tokens on every request, navigation that keeps the Shopify admin's chrome in sync. Getting this wrong produces an app that works for you and breaks for merchants with stricter browser settings.

An authenticated API client. authenticate.admin(request) returns a client with the token already attached and rate-limit-aware retries built in.

Webhook registration and verification. Subscriptions declared in shopify.app.toml are registered on install; incoming requests are HMAC-verified with the raw body handled correctly. That raw-body detail alone breaks a lot of hand-rolled handlers — see webhooks.

Polaris. Shopify's design system, so the app looks like part of the admin.

Extension scaffolding. generate extension for admin UI, checkout UI, theme app extensions and Functions, wired into the same deploy.

Deployment of app config. npm run deploy pushes configuration and extension versions to Shopify, so what's declared in the repository is what's live.

What it assumes

• Node and JavaScript or TypeScript.
• A server-rendered app, which suits admin apps well.
• A database for session storage in production. SQLite is a local convenience, not a deployment target.
• A hosting environment that gives you a stable HTTPS URL and can run a Node server.

The shape of the code

Remix's loader and action model maps neatly onto Shopify work:

```js export async function loader({ request }) { const { admin } = await authenticate.admin(request); // read data for this screen }

export async function action({ request }) { const { admin } = await authenticate.admin(request); // handle a form submission or mutation } ```

Authentication is a single call at the top of every route. That uniformity is most of the value — there's no route where you might have forgotten to verify the request.

When a different stack is reasonable

• Your team doesn't write JavaScript. An app in Rails, Laravel, Django or Go is entirely legitimate. Shopify publishes API libraries for several languages.
• The app is mostly backend. A sync service with almost no UI doesn't need a frontend framework — it needs a queue, a scheduler and good logging. That's an integration more than an app.
• It's part of an existing system. If your company already runs a platform, adding Shopify endpoints to it beats standing up a separate service.

If you go your own way, you're taking on OAuth, session tokens, webhook verification and embedding yourself. That's a few days of work and a permanent surface for security bugs. Budget for it honestly.

What it doesn't decide for you

The template gives you a working shell. It has no opinion about your data model, your background jobs, your queue, your monitoring, or how you reconcile state when webhooks go missing. Those are where the real engineering is, and they're the same problems in any stack — the ones that make app cost what it is.

The template's value isn't that Remix is the best framework. It's that the twelve things everyone gets wrong about Shopify authentication are already right.