Checkout Extension Network Access: What Shopify Actually Allows
Checkout UI extension network access is a declaration plus an approval, not a wall: your extension names network_access in shopify.extension.toml, and Shopify requires you to request access before you can publish it. BUILD stays the right call for Plus merchants, with 4 declarable capabilities in total and a 64 KB compiled bundle ceiling. Budget the request into the launch date.
Your profile — see how the verdict shifts
- Confidence
- High — Shopify's checkout capabilities page names all four capabilities and both behaviors verbatim, re-read on 2026-09-05: api_access, network_access, block_progress, collect_buyer_consent. The load-bearing sentence is the request step. If your extension specifies the network_access capability, you must request access in order to publish your extension. That is a process dependency, not a technical block, which is why the verdict is BUILD rather than WAIT. The second behavior matters at runtime rather than at build time: setting block_progress in the shopify.extension.toml file informs merchants that your extension blocks the buyer's progress for invalid orders, and merchants can allow or disallow this capability in the checkout editor. A merchant switching it off changes what your extension can enforce, so it is a design constraint as much as a permission. Two plan gates sit underneath all of it. Checkout UI extensions that render on the information and shipping and payment steps in checkout are available only to stores on a Shopify Plus plan, and Thank you and Order status extensions are available to all plans except Shopify Starter. The compiled bundle ceiling is documented at 64 KB and enforced at deployment. On the app side, the two live listings read the same day are Checkout Blocks (4.2★, 212 reviews) and Zoorix (4.9★, 392 reviews, Built for Shopify). One dated caveat belongs on the Checkout Blocks row: Shopify's manual states its branding editor is deprecated and will be removed on December 31, 2026.
- Reference scenario
- $20M–$100M GMV · Shopify Plus · a custom checkout UI extension that reads or writes data outside Shopify · agency or in-house dev bench
- As of
- September 2026
Decision at a Glance
| Your profile | Verdict | Why |
|---|---|---|
| Not on Shopify Plus | BUY | Checkout UI extensions on the information, shipping and payment steps are Plus-only. Thank you and Order status extensions reach every plan except Shopify Starter, and an App Store app covers the rest. |
| Plus · the extension needs no data from outside Shopify | BUILD | api_access alone reads checkout state, and no approval step sits between you and publishing. The whole capability question costs one line of TOML. |
| Plus · the extension calls your own endpoint | BUILD | network_access changes the launch date rather than the architecture. Shopify requires the request before publishing, so file it in week one instead of the week you ship. |
| Plus · the requirement is standard checkout merchandising | BUY | Upsells, custom fields and cross-sell blocks are already listed and maintained. Zoorix runs $0/month to $29.99/month (verified Sep 2026), which no build beats on cost. |
What Checkout Extension Capabilities Actually Drives
| Outcome | Impact | How it works |
|---|---|---|
| Revenue — direct | Medium | Checkout blocks that upsell, bundle or reassure at the payment step move order value on the page where intent is highest and abandonment is cheapest to prevent. |
| Customer experience | High | An extension renders the delivery note, gift option or eligibility message inside checkout rather than forcing the shopper back to the cart to change something. |
| Operational efficiency | Medium | Collecting the field at checkout instead of chasing it by email after the order removes an entire support loop from every affected order. |
| Data & insight | Medium | Fields your own extension collects land in systems you control, where an app's checkout data usually lands in the vendor's platform first. |
| Revenue — indirect | Low | The capability model itself moves no revenue; its effect arrives through what the extension is allowed to do once published. |
Spend ceiling: Spend on the block that carries a commercial reason, not on rebuilding merchandising a $29.99/month listing already ships (verified Sep 2026). The capability declaration costs one line of TOML; the request behind network_access costs schedule, and that is the number worth managing.
What buying enables (top apps)
- + Standard checkout merchandising live this week, with cross-sell, bundles and content blocks maintained against every Shopify checkout release
- + No capability request to file, because the vendor already cleared review for the extension you install
- + Fixed, low monthly cost with a genuinely usable free tier on at least one listing
What building additionally unlocks
- + Exactly the field, rule or message the business asked for, rendered on the core checkout steps a Plus store can reach
- + Control over where checkout-collected data goes, instead of it landing in a vendor platform first
- + An outbound call from checkout when the requirement genuinely needs one, once Shopify grants the network_access request
- + Enforcement paired correctly: the message in the extension, the rule in a validation function a merchant can't switch off
Find Your Verdict in 3 Questions
Is the store on Shopify Plus?
Yes: Go to question 2.
No: Your verdict: BUY — extensions on the information, shipping and payment steps are Plus-only, so a listed app is the practical route.
Does a listed app already render the block you need?
Yes: Your verdict: BUY — a $0 to $29.99/month listing (verified Sep 2026) beats any build on cost when the requirement is standard.
No: Go to question 3.
Does the extension have to reach data outside Shopify at render time?
Yes: Your verdict: BUILD — declare network_access, file the request first, and precompute anything that doesn't have to be live.
No: Your verdict: BUILD — api_access alone publishes with no request, so the only limit worth designing around is the 64 KB bundle.
The TCC Scorecard — 12 Dimensions
TCC — Total Cost of Capability: what it actually costs to have this capability over three years, whichever way you get it. Each dimension is scored 0–5 for both paths. How we score →
| Dimension | Buy | Build | Why |
|---|---|---|---|
| Cost | |||
| Acquisition & implementation | A listed checkout app installs and configures in an afternoon; a custom extension is a repo, a review cycle and possibly a capability request. | ||
| Recurring fees | The two named listings run from free to $29.99/month (verified Sep 2026); a custom extension you own carries no subscription line. | ||
| Maintenance & upgrades | Vendors track checkout API versions for you; your own extension needs version bumps and a re-test each time the checkout API moves. | ||
| Switching & exit | An app's checkout blocks vanish with the uninstall; your extension's code and its data model stay in your repository. | ||
| Risk | |||
| Vendor risk | Review bases of 212 and 392 are healthy but modest, and Shopify's manual already dates the removal of the Checkout Blocks branding editor to December 31, 2026. | ||
| Security & compliance surface | network_access puts an outbound call in the checkout path, which is precisely why Shopify reviews the request before you publish. | ||
| Platform-deprecation exposure | Checkout extensibility is the platform's forward path, but the capability list and the 64 KB bundle ceiling are Shopify's to revise. | ||
| Value | |||
| Fit to requirement | Apps ship the blocks their roadmap chose; an extension you write renders exactly the field, rule or message the business asked for. | ||
| Time to market | Live this week against 3–7 weeks for a custom extension (Deploi estimate, illustrative), plus an unknown wait when network_access is declared. | ||
| Performance & scale | Both lanes obey the same 64 KB compiled bundle limit, enforced at deployment, so neither can bloat checkout unnoticed. | ||
| Data ownership & AI-readiness | Data an app collects at checkout lands in the vendor's system; the same field collected by your extension lands wherever you send it. | ||
| Focus & opportunity cost | Buying back the standard blocks is a good trade; writing your own is worth it only for the block that carries a commercial reason. | ||
The App Landscape
| App | Status | Pricing | Best for |
|---|---|---|---|
| Shopify Checkout Blocks | Native — First-party Shopify app; 4.2★, 212 reviews; free. Its content blocks continue, but help.shopify.com states its Plus-only branding editor is deprecated and will be removed on December 31, 2026. Not a third-party alternative: it is Shopify's own extension of the native path. | Free, full access at no cost (verified Sep 2026) | Plus merchants adding standard checkout content without writing an extension |
| Zoorix: Bundles & Cross Sell | Live — 4.9★, 391 reviews; Built for Shopify. The Forever Free plan includes every feature (cross-sell, bundles, volume discount, cart drawer, mix and match, recommendations) with Zoorix branding shown; paid tiers remove branding and are sized by the revenue the app generates, $100–200 a month on Basic up to $400–800 on Premium (verified Sep 2026). | Forever Free (all features, branding shown); Basic $7.99/month; Growth $14.99/month; Premium $29.99/month; 30-day free trial on paid plans (verified Sep 2026) | Cross-sell and bundle blocks in checkout at a fixed low monthly cost |
| Custom checkout UI extension (custom app) | Build lane — Your own extension, with capabilities declared in shopify.extension.toml and network_access requested before publishing. Extensions rendering on the information and shipping and payment steps require Shopify Plus. The compiled bundle can't exceed 64 KB, which is a design constraint on how much logic and how many assets ship inside checkout. | $14,000–$35,000 one-time plus upkeep (Deploi estimate, illustrative) | Plus merchants whose checkout requirement carries a commercial reason no listing covers |
The Build Path
- Declare only the capabilities the extension truly needs: Four exist: api_access, network_access, block_progress and collect_buyer_consent. Each is a line in shopify.extension.toml, and each one you add is a claim you have to justify. An extension that reads checkout state and renders a message needs api_access alone, publishes without a request, and ships on your own schedule.
- File the network_access request the week you scope, not the week you ship: Shopify states that an extension specifying network_access must request access in order to publish. No published response time exists, so the honest plan treats it as an unknown-length dependency in front of your launch date. Build against a stub endpoint in the meantime so the request is the only thing on the critical path.
- Design for a merchant switching block_progress off: Setting block_progress informs merchants that your extension blocks the buyer's progress for invalid orders, and merchants can allow or disallow this capability in the checkout editor. A rule that must always hold belongs in a cart or checkout validation function, which the merchant cannot toggle. Use the extension for the message and the function for the enforcement.
- Keep the compiled bundle under 64 KB: Shopify enforces the limit at deployment, so the failure arrives at the worst moment rather than in review. Move images to the CDN, avoid pulling a component library into checkout, and measure the bundle in CI. Precompute anything heavy into a metafield rather than shipping the logic that derives it.
- Effort band
- $14,000–$35,000 for one production checkout UI extension with tests and a capability request — Deploi estimate (illustrative); lands in the $25–75K contact-form band
- Typical timeline
- 3–7 weeks of build (Deploi estimate, illustrative), plus an unknown wait on the network_access request when the extension calls an external endpoint
- Maintenance, honestly
- ~15–20% of build cost per year (Deploi estimate): roughly $2,100–$7,000/yr (Deploi estimate, illustrative) for checkout API version bumps, bundle-size discipline and re-testing after each Shopify checkout release.
- What you own — and what you take on
- You own: the rendered experience, the data the extension collects and where it goes, and the capability declarations themselves. You take on: Shopify Plus as a hard dependency for the core steps, an approval step you don't control, and a merchant toggle that can disable block_progress.
3-Year Total Cost of Capability
| Buy (app path) | Build (custom path) | |
|---|---|---|
| Year 0 (setup) | $0–$900 (illustrative) | $14,000–$35,000 (Deploi estimate, illustrative) |
| Years 1–3 (recurring) | $0–$1,080 (illustrative) | $6,300–$21,000 (maintenance, Deploi estimate) |
| 3-year total | ≈$0–$1,980 (illustrative) | ≈$20,300–$56,000 (Deploi estimate) |
- † All figures illustrative samples for the reference scenario — not quotes, not verified pricing.
- † Left column holds one listed checkout app at its highest published tier, flat for three years.
- † Right column is one custom checkout UI extension with tests and a capability request; three-year horizon.
What the Sticker Price Hides
On the buy path
- — Built for Shopify requirements state that features exclusive to Shopify Plus must be hidden for non-Plus merchants, so a listing's screenshots may show blocks your plan never sees
- — Checkout Blocks lists a single free plan, but Shopify's manual dates the removal of its branding editor to December 31, 2026 (verified Sep 2026)
- — Data collected by an app's checkout block lands in the vendor's system first, which is a privacy review your team still owns
- — Zoorix's Forever Free plan shows app branding in checkout, and removing it is what the $7.99/month tier buys (verified Sep 2026)
On the build path
- — An extension declaring network_access can't be published until Shopify grants the request, and no response time is published
- — The compiled bundle can't exceed 64 KB and Shopify enforces it at deployment, so bundle growth fails a release rather than a review
- — Merchants can allow or disallow block_progress in the checkout editor, so an extension-only rule is not an enforcement guarantee
- — ~$2,100–$7,000/yr upkeep (Deploi estimate, illustrative)
What Merchants Say
Dev leads describe writing the extension first and reading the capabilities page second, then discovering the network_access request sits in front of publishing rather than behind it.
The recurring checkout-app complaint is boundary rather than bugs: the block renders, but the one field the business actually needed is the one the vendor's schema has no room for.
If You Change Your Mind Later
If you bought and outgrow it
Uninstalling a checkout app removes its blocks from checkout the same day, along with any configuration held in the vendor's dashboard. Export what the app collected before the last billing cycle, and check whether the fields it wrote live on the order or only in its own system.
If you built and want out
Your extension is code you version and can redeploy, and the capability declarations travel with it. Nothing is stranded on removal. The dependency that does not travel is Shopify Plus, without which extensions on the core checkout steps stop being installable at all.
When This Answer Changes
We're watching for:
- ▸ Any change to the capability list beyond today's four, which would move where the approval boundary sits
- ▸ Removal of the Checkout Blocks branding editor on December 31, 2026, which merchants using it for checkout styling need a destination for
- ▸ A change to the 64 KB compiled bundle ceiling, which today shapes how much an extension can carry into checkout
Verdict change log:
No changes since first publication (September 2026).
Common Questions
Can a checkout UI extension call an external API?
Yes, with the network_access capability declared in shopify.extension.toml and approved by Shopify first. The capability page states that an extension specifying network_access must request access in order to publish. The other 3 capabilities carry no such request. Plan the approval as a dated launch dependency rather than a build task.
What are the checkout extension capabilities?
Checkout UI extensions declare four capabilities as of September 2026: api_access, network_access, block_progress and collect_buyer_consent. Each one is named in the extension's shopify.extension.toml file. Setting block_progress informs merchants that the extension blocks the buyer's progress for invalid orders, and merchants can allow or disallow it in the checkout editor. Only network_access requires a request to Shopify before publishing.
Do we need Shopify Plus to ship our own checkout UI extension?
Yes for the core checkout steps. Shopify states that checkout UI extensions rendering on the information and shipping and payment steps are available only to stores on a Shopify Plus plan. Thank you and Order status extensions reach all plans except Shopify Starter. A compiled extension bundle can't exceed 64 KB, on every plan.
Your Next Steps
If you're going with BUILD(matches your selected profile)
- List every capability the extension needs and delete the ones it merely might use
- File the network_access request in the scoping week if the extension calls an external endpoint
- Move any rule that must always hold into a cart or checkout validation function, out of reach of the merchant toggle
- Add a bundle-size check to CI against the 64 KB deployment ceiling
- Re-test against each checkout API version rather than waiting for a shopper to find the break
If you're going with BUY
- Confirm the listing's Plus-only features are the ones you actually need, since Built for Shopify requires them hidden from non-Plus merchants
- Ask where data the block collects is stored and what leaves with an uninstall
- Check the free tier's conditions, including whether app branding shows in your checkout
- Diary a re-decision if Shopify's December 31, 2026 removal of the Checkout Blocks branding editor touches your setup
Official Docs & Sources
- Checkout UI extension capabilities — shopify.dev
- Checkout UI extensions API reference — shopify.dev
- Checkout extensibility technologies and plan gates — shopify.dev
Official documentation linked for verification — our verdicts and estimates are our own.
Related Decisions
Cart Transform vs. a Bundle App: Who Owns Pricing?
Overriding a bundle line's price, title and image with Cart Transform's lineUpdate works only on development stores or Shopify Plus; bundle apps cover the rest.
Should You Run a Custom Cart Transform Alongside an App's?
Shopify caps cart transform functions at one per app rather than one per store, and runs every app's function, so a custom one can sit beside a bundle app's.
Branding API vs. the Free Checkout Editor: Do You Need Code?
The free checkout and accounts editor covers most branding on every plan; Plus API overrides add precision, and the Checkout Blocks branding editor ends 2026-12-31.
Core Checkout Steps vs. Thank You: What's Plus-Only?
Custom UI on the information, shipping and payment steps is Plus-only; Thank You and Order Status extensions are open on every plan except Starter.
Should You Build or Buy Your Shopify Scripts-to-Functions Migration?
A Scripts-to-Functions migration is a build for any store whose checkout logic still earns money — unported rules have already gone silent.
Planning a custom checkout extension?
We read the capability list before anyone writes code, file the network_access request early so it isn't the thing holding up launch, and keep enforcement in a function where a merchant toggle can't switch it off.
Contact us todayVerdict scored for the reference scenario above. Estimates are not quotes; app pricing carries its verification date and gets re-verified quarterly. Full scoring anchors: see the TCC methodology.
Read how we score these decisions (the TCC Framework). No affiliate links, no paid placement — no app vendor pays to appear here.