Apps and app blocks

Ship an app that adds blocks to the page builder, requests scopes honestly and runs sandboxed on the storefront.

Version v1 · updated 2026-02-01

An app declares what it needs in a manifest. The install consent screen renders that manifest verbatim, so what the merchant approves and what the runtime grants are the same list — there is no hidden capability.

app.manifest.json

{
  "id": "reviews-pro",
  "name": { "en": "Reviews Pro", "bn": "রিভিউস প্রো" },
  "scopes": ["products.read", "orders.read"],
  "blocks": [
    {
      "type": "reviews.summary",
      "label": { "en": "Review summary", "bn": "রিভিউ সারাংশ" },
      "targets": ["product"],
      "hydration": "visible"
    }
  ],
  "settings_schema": [
    { "id": "min_rating", "type": "number", "min": 1, "max": 5, "default": 4 }
  ],
  "webhooks": ["order.paid"]
}

The sandbox#

Block code runs in a sandboxed frame with no ambient access to the host page's DOM, cookies or storage.
Data arrives through a declared props contract, so a block cannot read a customer record it never asked for.
Network egress is limited to your declared origins; anything else is blocked and counted.
A block that exceeds its render budget is unmounted and the placeholder keeps the layout stable — no CLS.