# System Design: Design Shopify — E-Commerce Platform, Multi-Tenant, Storefront, Checkout, Inventory, Themes, Apps

Source: https://www.techinterview.org/post/3233474474/system-design-design-shopify-e-commerce-platform-multi-tenant-storefront-checkout-inventory-payments-themes-app-ecosystem/
Updated: 2026-04-21 · techinterview.org

Shopify powers 4+ million online stores across 175 countries, processing $200+ billion in GMV annually. Designing a multi-tenant e-commerce platform tests your understanding of: multi-tenancy at massive scale, customizable storefronts, high-availability checkout (revenue directly tied to uptime), inventory management across channels, and building an extensible app ecosystem. This guide covers the platform architecture for system design interviews.

## Multi-Tenant Architecture

4 million stores share the same infrastructure. Isolation: (1) Data isolation -- each store has a shop_id. Every database query includes shop_id. A store cannot access another store data. Sharding: stores are distributed across database shards by shop_id. Each shard serves ~10,000 stores. A shard is a PostgreSQL cluster (primary + replicas). (2) Performance isolation -- one store traffic spike must not affect others. Rate limiting per store: API calls (40/sec for standard plans), bandwidth limits, and query complexity limits. If a store goes viral (flash sale), auto-scaling handles the load without impacting co-tenanted stores. (3) Custom domains -- each store has a unique domain (mystore.com) mapped to the Shopify platform. SSL certificates are provisioned automatically (via Lets Encrypt) for each custom domain. The CDN/load balancer routes based on the Host header to the correct store. (4) Compute isolation -- storefronts are rendered per-request with the store theme. Each render is stateless and isolated. No store can execute code that affects another. Liquid (Shopify template language) is sandboxed -- no system calls, no file access, no network calls from templates. Scale: Shopify handles Black Friday peaks of 1M+ checkouts per minute. The platform pre-scales infrastructure before known high-traffic events (BFCM preparation starts months in advance).

## Storefront and Theme System

Each store has a customizable storefront (the customer-facing website). Architecture: (1) Theme engine -- themes are written in Liquid (a sandboxed template language created by Shopify). A theme defines: layouts (header, footer, content area), templates (product page, collection page, cart), sections (reusable components: hero banner, featured products, testimonials), and assets (CSS, JavaScript, images). (2) Rendering pipeline -- on each page request: identify the store (Host header -> shop_id), load the active theme, fetch the page data (products, collections, navigation), render the Liquid template with the data, and serve the HTML. Caching: rendered pages are cached at the CDN edge (with short TTL for dynamic content like prices/inventory). Cache invalidation on: product update, theme change, or inventory change. (3) Storefront API -- a GraphQL API for headless commerce. Merchants build custom frontends (React, Next.js, mobile apps) and use the Storefront API for product data, cart management, and checkout. Hydrogen: Shopify React framework for custom storefronts with built-in optimizations (streaming SSR, cache management). (4) Customization without code -- the theme editor: a drag-and-drop interface for merchants to customize sections, colors, fonts, and content without touching code. Changes are previewed in real-time and published atomically. Performance: Shopify measures and reports storefront speed score. Themes must meet performance budgets (total page weight, Time to Interactive). Slow themes are flagged in the theme store.

## Checkout System

The checkout is the most critical path -- downtime directly equals lost revenue. Architecture: (1) Cart -> Checkout conversion -- the cart (client-side state + server validation) transitions to a checkout (server-side, persistent). The checkout stores: line items, shipping address, shipping method, payment method, discount codes, taxes, and total. (2) Checkout steps: information (email, address), shipping (method selection with real-time rate calculation from carriers), and payment (card tokenization via Shopify Payments/Stripe or alternative gateways). (3) Payment processing -- Shopify Payments (built on Stripe) handles most transactions. Alternative gateways (PayPal, Klarna, Affirm) via a gateway API. Each payment is: authorized (hold funds), then captured on fulfillment (or immediately for digital goods). Idempotency keys prevent double-charging. (4) Reliability -- checkout runs on dedicated, over-provisioned infrastructure. Separate from the storefront (a storefront outage does not affect in-progress checkouts). Multi-region deployment. Database: dedicated checkout database shards separate from product/theme databases. (5) Shop Pay -- accelerated checkout. Returning shoppers have their information saved (address, payment) across all Shopify stores. One-tap checkout: skip the information and shipping steps. Conversion rate: Shop Pay converts 1.7x higher than regular checkout. Fraud detection: ML model scores each checkout for fraud risk. Signals: velocity (many orders from the same IP), AVS mismatch (billing address does not match card), high-risk countries, and behavioral signals (time on page, mouse movement patterns).

## Inventory and Order Management

Inventory spans multiple locations: warehouses, retail stores, and drop-shippers. Data model: inventory_item_id, location_id, available_count, committed_count (reserved by unpaid orders), on_hand_count (physical stock). available = on_hand - committed. Multi-location fulfillment: when an order is placed, the system determines which location(s) fulfill it. Routing rules: closest to the customer (minimize shipping cost/time), location with sufficient stock, and split-order threshold (split across locations only if one location cannot fulfill entirely -- splitting increases shipping cost). Inventory decrement: on checkout completion, atomically commit the inventory. UPDATE inventory SET committed = committed + quantity WHERE available >= quantity. If insufficient: the checkout fails with "item out of stock" (rare -- pre-checked at add-to-cart and checkout start, but possible due to concurrent checkouts). Channel inventory: the same product is sold on: the online store, POS (in retail stores), and marketplace channels (Amazon, Facebook Shops, Google Shopping). Inventory is shared or allocated per-channel. If allocated: each channel has its own inventory pool. If shared: all channels draw from the same pool (risk of overselling if sync is slow). Shopify syncs inventory across channels in near-real-time (seconds). A sale on any channel immediately decrements inventory visible on all channels.

## App Ecosystem and Extensibility

The Shopify App Store has 8000+ apps extending platform functionality: email marketing (Klaviyo), reviews (Judge.me), subscriptions (Recharge), fulfillment (ShipBob), and thousands more. App architecture: (1) OAuth authentication -- apps authenticate via OAuth 2.0. The merchant installs the app, granting specific permissions (read_products, write_orders, read_customers). Apps receive an access token scoped to the store. (2) REST and GraphQL Admin APIs -- apps read and write store data: products, orders, customers, inventory, and metafields (custom data). Rate limited per store: 2 requests/second (REST) or a cost-based limit (GraphQL). (3) Webhooks -- apps subscribe to events: orders/create, products/update, app/uninstalled. Shopify delivers webhooks when events occur. Apps process asynchronously. (4) Theme app extensions -- apps inject UI into the storefront (product reviews widget, size chart, loyalty points). Rendered via app blocks in the theme (sandboxed, cannot break the store). (5) Checkout extensions -- apps customize the checkout experience: custom fields, upsells, payment method filtering, and address validation. Run in a sandboxed Web Worker (cannot access the main checkout DOM -- security critical). (6) Functions -- server-side logic that runs within Shopify infrastructure (not on the app server). Discount functions, delivery customization, and payment customization. Written in WASM (compiled from Rust/JavaScript), executed in a sandbox with strict time and memory limits. This enables customization without external network calls (faster, more reliable checkout).