Going live
Once a version is approved the app is on the marketplace and merchants can install it. Most of what follows is about staying out of your own way.
What a merchant sees
Your listing travels with the version, so it is reviewed alongside the contract:
| Field | Notes |
|---|---|
name, tagline | The two lines that decide whether anyone opens the page |
description | What it does, for someone who has not heard of you |
category, features | How it is found |
icon, screenshots | Uploaded through the dashboard |
displayVersion, changelog | What changed, for merchants who already have it |
All of it is optional at the API level — a first version can omit every field and still be reviewed. It will not be a listing anyone installs.
The install screen shows the permissions, not your justifications. Those are for the reviewer. A merchant declining at that screen is usually declining a list that looked longer than the app sounded.
Consent is per install, and it caps your token
What a merchant granted is stored on their installation as grantedScopes, and
your access token is capped to that — not to what your manifest asked for.
An app approved for ten permissions on a store that granted six can do six
things there.
This is also why PENDING_REAUTH exists rather than a hard stop: consent is a
property of the install, so it can lag the version without breaking it.
Deploying, forever after
Nothing. Your code is yours, on your own infrastructure, on your own schedule. Come back only when the contract changes — see Submit for review.
Two operations you will need
Withdraw
Pulls a pending version out of review. It does not remove your app from the marketplace, and it does not touch merchants already running an earlier version.
Rotate the secret
Mints a new tqs_… and replaces the stored hash.
It takes effect immediately, with no grace period. Every server of yours still holding the old secret starts failing at that moment, so deploy the new one first and rotate second — not the other way round.
Rotate when a credential has been exposed, when someone with access to it leaves, and on whatever schedule your own security policy says. There is no way to read an existing secret back: only its hash is stored, which is the same reason the first one is shown once.
When something goes wrong for one merchant
Their installation carries its own webhook delivery log. Open the app, open the installation, and you can see every attempt and replay the ones your handler dropped — see Quickstart.
That log is yours alone. A merchant's own native webhooks never appear in it.