Taking Over a Shopify App From Another Developer: A Checklist

A custom Shopify app often outlives the relationship with the person who built it. The freelancer moves on, the agency closes, or you simply want someone new. The app keeps running, until an API version expires, a credential leaks or a webhook starts failing, and nobody knows where to look.

This checklist covers what to secure first, what to collect from the previous developer, and what a new developer should review before changing anything. It applies to custom apps made for your store and to integrations built around them.

First, secure access

Do these before anything else, even if the parting is friendly.

• Review who can open your store. In the Shopify admin, check staff and collaborator accounts. Remove the ones that are no longer needed, and give the new developer their own collaborator access with only the sections they need.
• List the installed apps. Note every custom app on the store and what it is for. An app nobody can explain is the first thing to ask about.
• Find the credentials. Access tokens, API keys and client secrets can live in a hosting dashboard, an environment file or a password manager. Once the new developer has control of the app’s hosting and configuration, rotate them, so the old copies stop working.
• Check other systems too. If the app talks to an ERP, a 3PL or an accounting tool, its credentials for those systems need the same treatment.

Find out who owns the app

This is the question that most often causes trouble. A custom app is created in a Shopify organization, in the Partner Dashboard or, for new custom apps since January 1, 2026, in the Dev Dashboard. If it was created in the previous developer’s organization, they still control its settings and credentials.

Shopify’s documentation describes transferring stores, not moving an app from one organization to another, so plan as if the app stays where it was created. In practice there are two routes:

1. The previous developer adds you, or your new developer, to the organization that holds the app, with the access needed to manage it. This is quickest when the parting is cooperative.
2. A new app is created under an organization you control, and the code is deployed to it. The store installs the new app, and the old one is removed once the new one works.

The second route is cleaner for the long term, but it is not free. A new app gets new credentials, and it must be installed and its permissions approved again. Data an app keeps in its own reserved metafield namespace belongs to that app, so plan to copy what the new app needs before the old one is uninstalled. Ask Shopify Support if your case is unusual.

If you are hiring someone new, have the app created under your own organization from the start. Our guide to creating a custom app in the Dev Dashboard shows the steps.

Collect from the previous developer

Ask for these in writing. A cooperative developer can usually hand them over in a day.

• The code repository, with its full history, not only a copy of the latest files.
• Where the app runs. The hosting provider, the account it is under, and the domains and DNS records it uses.
• How it is deployed, and how to turn it off safely.
• The list of accounts involved. Shopify organization, hosting, database, email sending, error tracking and any paid services, and who pays for each.
• Scheduled jobs and webhooks. What runs on a timer, and which Shopify events the app listens to.
• Known problems. Anything that fails now and then, and how it was handled.

If the previous developer cannot be reached, the new developer can rebuild most of this list from the code and the hosting account. It takes longer, which is why the next step matters.

What a new developer should review

Before adding features, a new developer should check the app’s health. A short review usually covers:

• API version. Which Admin API version the app calls. Shopify supports each stable version for at least 12 months, and a request to an unsupported version is answered by the oldest supported one, which can quietly change results. See the API version upgrade checklist.
• REST or GraphQL. The REST Admin API has been legacy since October 1, 2024. An older app may still depend on it. See REST to GraphQL migration.
• Webhooks. Which ones are registered, whether they are verified, and what happens when one is missed or arrives twice. Shopify integrations that don’t break covers the patterns.
• Platform changes. Recent changes that can leave an older app behind: Shopify Scripts ended on June 30, 2026, Thank you and Order status page scripts were sunset, and market-driven shipping is rolling out.
• Permissions. Which access scopes the app asks for, and whether it still needs all of them.
• Data. What the app stores about your customers and orders, where, and whether it handles customer data requests.
• Monitoring. Whether anyone is told when the app fails, or whether you find out from a customer.

The result should be a written list of what works, what is at risk and what to fix first. Fix the risks before adding anything new.

Keep the next handover easy

Once the app is under control, set it up so the next change of developer is simple:

• The app, its hosting and its accounts are created under your organization.
• The code lives in a repository you own.
• A short document says what the app does, where it runs, how to deploy it and how to turn it off.
• Credentials are kept in one place you control and rotated when people leave.

Our guide to maintaining a custom Shopify app includes a full handover checklist.

FAQ

Can I move a custom Shopify app from my old developer’s account to mine?

Shopify’s documentation does not describe moving an app between organizations. Either get access to the organization that holds the app, or create a new app under your own organization, deploy the code to it and reinstall. Ask Shopify Support if you are unsure.

What should I do first when a Shopify developer leaves?

Review collaborator and staff access, list the custom apps on your store, and find where the app’s credentials live. Rotate the credentials once the new developer controls the app’s hosting.

Can a new developer work on an app without the old one’s help?

Usually, yes, as long as you have the code and access to the hosting. It takes longer, because the new developer has to rebuild the list of accounts, jobs and webhooks from the code.

Should a new developer rewrite the app?

Rarely as a first step. A review usually shows a few clear risks to fix, such as an expiring API version or unverified webhooks. Rewriting makes sense only when the review shows the app cannot be safely kept up to date.

Talk to us

The team behind StoreFleet: Inventory Sync, Shopify app developers building for e-commerce since 2021, takes over Shopify apps other developers built, starting with a short review. Our page on hiring Shopify app developers explains what we take on, and you can send a short brief from there.