Flow's Run Code Action or a Custom App: Where's the Ceiling?
Flow's Run code action is a CUSTOMIZE inside a tight box: ECMA2020 JavaScript, 5 seconds of execution, 10MB of memory and 50,000 characters of code. Imports and network calls are unavailable, so a package, a database or an outbound request means BUILD a real app or service. Input data query and output data schema cap at 5,000 characters each.
Your profile — see how the verdict shifts
- Confidence
- High — Read Shopify's Run code reference: the action supports ECMA2020 JavaScript, total execution duration is limited to 5 seconds, memory usage is limited to 10MB, code can't be longer than 50000 characters, the input data query is limited to 5000 characters, the output data schema is limited to 5000 characters, and the output data payload plus Console.log output are limited to a combined 50KB (verified Sep 2026). The same page states the action doesn't support NodeJS or CommonJS, which is what removes imports and outbound requests from inside the step. Read the Send HTTP Request reference: outbound calls are a separate action, available on the Plus, Advanced and Grow plans, and that page frames a Run code step as an optional way to parse the response body rather than a required one. Searched the App Store's workflow-automation category: MESA is the closest verified vendor at 5.0★ across 153 reviews, and no listing reviewed offers a general-purpose code step with a larger budget than Shopify's own.
- Reference scenario
- $20M–$200M GMV · Shopify Plus · an ops team writing occasional JavaScript inside Flow · logic covering pricing math, field mapping and payload shaping · a dev bench available for anything larger
- As of
- September 2026
Decision at a Glance
| Your profile | Verdict | Why |
|---|---|---|
| Field mapping, parsing and formatting | WAIT | Reshaping a payload or formatting a value finishes in milliseconds. Run code covers it natively at no cost, and nothing on the App Store improves on that. |
| Calculations over a bounded list | CUSTOMIZE | Pricing math or scoring across a few dozen line items fits inside 5 seconds and 10MB. Keep the output under the combined 50KB payload limit and it stays inside Flow. |
| Logic needing a library or a large lookup table | BUILD | Run code doesn't support NodeJS or CommonJS, so there is no import. Reimplementing a library by hand inside a 50,000-character budget is the wrong end of the trade. |
| Logic needing an outbound call, a database or state | BUILD | The step has no network access and no persistence between runs. Move the logic to a service, and let Flow call it with Send HTTP Request on the Plus, Advanced or Grow plans. |
What Flow Run Code Limits Actually Drives
| Outcome | Impact | How it works |
|---|---|---|
| Operational efficiency | High | Logic that would otherwise need a developer and a deploy gets written and shipped by the ops team the same day, inside the workflow it belongs to. |
| Revenue — indirect | Medium | Pricing, scoring and eligibility rules expressed in code reach production in days rather than sprints, so a promotion idea does not wait on a release train. |
| Data & insight | Medium | A hosted endpoint logs every input and decision to your own warehouse, while a Run code step leaves only Console.log output inside a 50KB budget. |
| Customer experience | Low | A step that times out on a large cart silently skips the rule it was meant to apply, which reaches the customer as an inconsistency rather than an error. |
Spend ceiling: Spend nothing while the logic fits: Run code is included with Flow on every plan from Basic upward. Reserve the $10,000–$30,000 build (Deploi estimate, illustrative) for the day the logic needs a package, persistent state or a network call.
What buying enables (top apps)
- + A second automation editor with its own connectors, for automations whose problem is the platform rather than the code
- + Vendor-maintained integrations to tools that have no Flow tasks of their own
- + MESA's 7-day free trial makes that comparison cheap before any migration (verified Sep 2026)
- + Someone else keeping those connectors working as APIs change
What building additionally unlocks
- + Packages, persistent state and outbound calls, none of which exist inside Run code
- + Execution time bounded by your own infrastructure rather than a 5-second ceiling
- + Tests, code review and version history for logic that currently lives in a text box
- + Full logs of every input and decision, kept as long as you want them
Find Your Verdict in 3 Questions
Does the logic need a package, a database, persistent state or an outbound call?
Yes: Your verdict: BUILD — move it to a hosted endpoint or a custom app action task, since Run code has none of those.
No: Go to question 2.
Does it finish comfortably inside 5 seconds and 10MB on your largest realistic input?
Yes: Go to question 3.
No: Your verdict: BUILD — a step that only passes on small orders will fail the week a large cart arrives.
Can Flow's native conditions and actions already express the rule?
Yes: Your verdict: WAIT — use the native blocks, because code you don't write needs no tests and no review.
No: Your verdict: CUSTOMIZE — write the Run code step, keep the source in version control, and re-check it against your largest inputs each quarter.
The TCC Scorecard — 12 Dimensions
TCC — Total Cost of Capability: what it actually costs to have this capability over three years, whichever way you get it. Each dimension is scored 0–5 for both paths. How we score →
| Dimension | Buy | Build | Why |
|---|---|---|---|
| Cost | |||
| Acquisition & implementation | A Run code step is written in an afternoon; a custom app or service around the same logic runs an estimated 4–8 weeks (Deploi estimate, illustrative). | ||
| Recurring fees | Automation subscriptions bill monthly; Run code is included with Flow, and a small hosted service costs far less than a metered platform. | ||
| Maintenance & upgrades | Code written in a workflow editor has no test suite and no version control unless you keep a copy in your repository. | ||
| Switching & exit | Logic in a vendor's step does not export; JavaScript you wrote moves to a service or an app with no rewrite of the rules themselves. | ||
| Risk | |||
| Vendor risk | No App Store listing reviewed offers a code step with a larger budget than Shopify's own, so the buy lane is thin for this specific need. | ||
| Security & compliance surface | Run code cannot reach the network, so the data it touches never leaves Shopify during the step. | ||
| Platform-deprecation exposure | The limits are published numbers on Shopify's own reference, and a design pinned to exactly 5 seconds has no headroom if they tighten. | ||
| Value | |||
| Fit to requirement | A service expresses any logic at all; Run code expresses whatever fits in 5 seconds, 10MB and no dependencies. | ||
| Time to market | A code step ships the same day, while a service needs hosting, deploys and an authentication story. | ||
| Performance & scale | 5 seconds and 10MB are hard stops that a growing cart or a longer list will eventually cross without warning. | ||
| Data ownership & AI-readiness | A service can log every input and decision to your warehouse; a Run code step leaves only Console.log output inside a 50KB budget. | ||
| Focus & opportunity cost | Squeezing real business logic into a workflow editor costs more review time than it saves in setup. | ||
The App Landscape
| App | Status | Pricing | Best for |
|---|---|---|---|
| Shopify Flow (Run code action) | Native — First-party Shopify app. The Run code action supports ECMA2020 JavaScript, with total execution limited to 5 seconds, memory to 10MB, and code to 50,000 characters. Input data query and output data schema are each limited to 5,000 characters, and the output data payload plus Console.log output share a 50KB budget. The action doesn't support NodeJS or CommonJS, so imports and outbound requests are unavailable inside the step. | Included on every plan from Basic upward (verified Sep 2026) | Self-contained logic that finishes in seconds with no dependencies |
| MESA: Workflow Automation | Live — 5.0★, 153 reviews; 7-day trial on all paid plans. A multi-step automation platform that reaches further across your stack than Flow's own actions. Useful for orchestrating a bulk job's surrounding steps, though it is an automation tool rather than a bulk-editing one, so it does not remove the need for a real bulk lane. | Basic $12/month; Flex $29/month; Pro $99/month; Unlimited $299/month (verified Sep 2026) | Moving an automation off Flow when the constraint is the platform rather than the logic |
| Workflow automation apps with code steps | Category — The App Store's workflow-automation category holds the alternatives merchants try next. Those listings replace the whole workflow rather than extending one step. No listing reviewed publishes a code-execution budget larger than Shopify's 5 seconds and 10MB, so the category does not lift this specific ceiling. | Free to roughly $300/month across the category (illustrative) — confirm on each listing | Relocating an automation whose logic outgrew Flow's editor entirely |
| Custom service called from the workflow | Build lane — Your logic in a hosted endpoint, invoked by Flow's Send HTTP Request action on the Plus, Advanced or Grow plans, or exposed as an action task in a custom app for Plus stores. Removes the 5-second, 10MB and no-imports limits at once, and gives you tests, version control and your own logs. | $10,000–$30,000 one-time plus roughly 15–20% a year in upkeep (Deploi estimate, illustrative) | Business logic that needs packages, persistent state or an outbound call |
The Build Path
- Stay inside the box while the logic fits: Write pure ECMA2020 JavaScript with no dependencies, keep the input data query and output data schema each under 5,000 characters, and hold the output payload plus Console.log output inside their combined 50KB budget (verified Sep 2026). Logic that fits belongs here, because nothing you build beats free and same-day.
- Make the call with Send HTTP Request, not with code: Run code has no network access, so the outbound call is a separate Flow action available on the Plus, Advanced and Grow plans. Shopify's own page frames a Run code step as an optional way to parse the response body afterwards, so simple integrations often need no code step at all.
- Keep the source in your repository: Code pasted into a workflow editor has no tests, no review and no history. Hold the canonical version in version control, paste it in on deploy, and you keep the one thing the editor cannot give you when the logic changes hands.
- Move out when the ceiling is the design constraint: A package, a lookup table larger than the 50,000-character code limit, persistent state between runs, or anything close to 5 seconds all point the same way. Move the logic into a hosted endpoint or a custom app action task, and leave Flow to orchestrate.
- Effort band
- $10,000–$30,000 build — Deploi estimate (illustrative). A single hosted endpoint replacing one over-large Run code step lands in the $10–25K contact-form band; a custom app exposing several action tasks, with tests and logging, lands in the $25–75K band
- Typical timeline
- 4–8 weeks (Deploi estimate, illustrative): about a week for the endpoint and its contract, the rest for authentication, tests, logging and the cutover
- Maintenance, honestly
- ~15–20% of build cost per year (Deploi estimate): roughly $1,500–$6,000/yr (Deploi estimate, illustrative) for hosting, dependency updates and Admin API version bumps. Run code itself carries no fee.
- What you own — and what you take on
- You own: the logic, its tests, its version history and the logs of every decision it made. You take on: hosting, authentication between Flow and your endpoint, and keeping the contract stable as the workflow around it changes.
3-Year Total Cost of Capability
| Buy (app path) | Build (custom path) | |
|---|---|---|
| Year 0 (setup) | $6,000–$16,000 (rebuild in another editor) | $10,000–$30,000 |
| Years 1–3 (recurring) | $3,600–$10,800 (subscription) | $4,500–$18,000 (hosting and maintenance) |
| 3-year total | ≈$9,600–$26,800 | ≈$14,500–$48,000 |
- † All figures illustrative samples for the reference scenario — not quotes, not verified pricing.
- † Buy path: MESA's Pro tier at $99/month (verified Sep 2026) plus a project to rebuild the affected automations in another editor, at illustrative agency rates.
- † Build path: one hosted endpoint replacing two over-large code steps, with tests, authentication and logging; three-year horizon; hosting included in maintenance.
What the Sticker Price Hides
On the buy path
- — No reviewed listing publishes a code-execution budget larger than 5 seconds and 10MB, so a move may relocate the limit rather than lift it
- — A second editor splits the automation library, and every change then needs two people to review
- — Metered plans price each run, including the ones that fail on a payload the code could not handle
- — Logic configured in a vendor step does not export, so switching means rewriting the rules by hand
On the build path
- — Code pasted into the workflow editor has no tests or version history unless you keep the source elsewhere
- — Authentication between Flow and your endpoint is small work that is easy to leave until last and easy to get wrong
- — Send HTTP Request waits a maximum of 30 seconds, so a slow endpoint fails the step even though the logic is correct
- — Roughly $1,500–$6,000/yr in hosting and upkeep (Deploi estimate, illustrative) that no subscription line makes visible
What Merchants Say
Developers describe the silent ceiling: the code step passes every test on a small order, then times out the first week a wholesale cart arrives with hundreds of lines.
Automation reviews cluster on debuggability: logic lives in a text box, nobody can diff it against last month's version, and the only trace of a run is whatever the author logged.
If You Change Your Mind Later
If you bought and outgrow it
Logic configured inside a vendor's step leaves as documentation rather than as code, so a switch means rewriting the rules by hand. Export the automation definitions and recent run history before cancelling, because the run history is the only evidence of how the logic behaved on real data.
If you built and want out
Nothing is stranded: the JavaScript you wrote moves from a Run code step into a service with the rules intact, and the endpoint can be called from anything later. Keeping the source in version control from day one is what makes that move a deploy rather than a rewrite.
When This Answer Changes
We're watching for:
- ▸ Any change to Run code's 5-second, 10MB or 50,000-character limits (all current as of September 2026)
- ▸ Support for imports or outbound requests inside Run code, which would remove the main reason to build a service
- ▸ Changes to the Plus, Advanced and Grow plan gate on Send HTTP Request, which is how a workflow reaches your endpoint
Verdict change log:
No changes since first publication (September 2026).
Common Questions
What are the limits on Flow's Run code action?
Shopify caps Run code at 5 seconds of total execution, 10MB of memory and 50,000 characters of code, running ECMA2020 JavaScript. The input data query and the output data schema are each limited to 5,000 characters. The output data payload and Console.log output share a combined 50KB. Each is a hard stop rather than a soft warning.
Can the Run code action call an external API?
No. Shopify's reference states the action doesn't support NodeJS or CommonJS, which removes imports and outbound requests from inside the step. Use Flow's Send HTTP Request action instead, available on the Plus, Advanced and Grow plans, which waits a maximum of 30 seconds for a response code. A Run code step can optionally parse the response body afterwards.
When should logic move out of Run code into a custom app?
Move it when you need a package, persistent state between runs, or a lookup table larger than the 50,000-character code limit. Anything approaching the 5-second ceiling should move too, because carts and lists grow. A hosted endpoint called by Send HTTP Request costs an estimated $10,000–$30,000 to build (Deploi estimate, illustrative) and removes all three limits.
Your Next Steps
If you're going with CUSTOMIZE(matches your selected profile)
- Run the step against your largest realistic input and record the actual duration against the 5-second ceiling
- Keep the canonical source in version control and paste it into Flow on deploy
- Hold the input data query and output data schema under 5,000 characters each
- Keep output payload plus Console.log inside their combined 50KB budget
- Re-check timing each quarter, since order sizes grow and the limit does not
If you're going with BUILD
- Write down the contract first: what goes in, what comes back, what happens on failure
- Host the logic behind an authenticated endpoint and call it with Send HTTP Request
- Keep the endpoint's response inside Flow's 30-second wait, and set the 5XX behavior deliberately
- Log every input and decision to your own store, which Run code could never do
- Cut over one workflow at a time and leave the old code step disabled, not deleted, for a week
Official Docs & Sources
- Run code action: limits and supported JavaScript — Shopify Help Center
- Send HTTP Request action — Shopify Help Center
- Shopify Flow plan availability — Shopify Help Center
Official documentation linked for verification — our verdicts and estimates are our own.
Related Decisions
Flow Loops or Bulk Operations for Hundreds of Shopify Records?
Flow's Get data actions run on lists of up to 100 items, so a For each loop cannot sweep a large catalog. Catalog-wide edits need a real bulk lane.
Your App Has No Flow Connector: Build the Bridge or Wait?
Only an app's own developer can ship its Flow tasks. Outbound automation needs just Send HTTP Request; inbound needs a bridge app from $29/month (verified Sep 2026).
Flow Failure Alerting on Shopify: Build the Watcher or Buy One?
Shopify ships no store-wide Flow alert. Build a watcher on the Workflow error occurred trigger, which fires once per workflow version within a 30-day window.
Flow Workflow Retries on Shopify: Build Your Own Safety Net?
Flow retries transient errors like step timeouts and 5XX statuses, and never retries permanent ones. Critical workflows need their own error branches.
Should You Build or Buy Site Search on Shopify?
Site search on Shopify splits by catalog size: native to ~1,000 SKUs, buy in the middle, build at big-catalog, search-led scale.
Is your Run code step about to hit 5 seconds?
We review what your workflow logic actually does, keep whatever fits inside Flow's budget, and move the rest to an endpoint with tests and logs behind it.
Contact us todayVerdict scored for the reference scenario above. Estimates are not quotes; app pricing carries its verification date and gets re-verified quarterly. Run code's limits are published numbers on Shopify's own action reference and can change, so confirm the current figures before you design against them.
Read how we score these decisions (the TCC Framework). No affiliate links, no paid placement — no app vendor pays to appear here.