Wholesale on Shopify usually starts the same way. A contact form collects trade enquiries, someone reads them between other jobs, and the good ones get an account created by hand with a note in the customer record. It works up to roughly twenty applications a month, and then it stops working, because nobody can tell who was approved, who was ignored, and who applied twice.
The fix is to make the application produce a real customer record from the first second, and to make approval a state change on that record rather than an email thread.
What to ask on the form
Start from the question: what do I actually need in order to say yes or no? For most merchants that is five fields.
- Email: becomes the account login, so it must be the buyer's real working address.
- Company name: what you will invoice.
- Tax or VAT number: the strongest single signal that a business is real.
- Phone: you will use it exactly once, when something is wrong with an order.
- One free-text line: what do you sell, and where.
Things people add that they should not: full billing and shipping address (Shopify collects it at checkout, correctly, with validation), expected annual spend (nobody answers honestly), how did you hear about us (put it in the welcome email instead), and a password field (let Shopify handle credentials).
Create the customer immediately, as pending
The instinct is to hold the submission somewhere and only create a Shopify customer once approved. Resist it. Create the customer on submit, tagged pending-approval.
- 1The buyer can set a password and log in straight away, and sees a clear "application under review" state instead of silence.
- 2Everything lives in one system. There is no second inbox to check and no risk of approving someone twice.
- 3Duplicate applications collapse naturally, because the email is already taken.
- 4Your existing tools work: customer segments, email flows, and search in the admin all see the record.
- 5Rejection is a tag change, not a deletion, so you keep the history of who asked.
A pending customer has no access to anything, because your locks grant access on the approved tag, not on the existence of an account. That distinction matters: gating on "is logged in" means anyone who registers is inside.
Store the extra fields as metafields
Company name, VAT number and business description go on the customer record as metafields, not into a note field and not into a separate database.
customer.primelock.company_name single_line_text_field
customer.primelock.vat_number single_line_text_field
customer.primelock.vat_status single_line_text_field valid | invalid | unchecked
customer.primelock.business_type single_line_text_field
customer.primelock.applied_at date_timeMetafields with a definition show up as proper fields on the customer page in the Shopify admin, so your team can read them without opening an app. They are also available to Flow, to email apps, and to your accountant's export. A note field is none of those things.
Validating VAT numbers against VIES
For EU trade, the European Commission runs VIES, a free service that confirms whether a VAT number is currently registered for intra-community trade, and usually returns the registered business name. Checking at submission time does two useful things: it stops typos becoming invoicing problems later, and it turns most approvals into a formality.
Two caveats worth knowing before you rely on it. VIES is a proxy to national tax databases and individual member states go offline for maintenance, so treat a failed lookup as "unchecked", never as "invalid". And some countries return only a validity flag without the trader name, so do not build a flow that requires the name to come back.
The approval queue
The queue is a list of customers carrying the pending tag, showing the metafields you collected and the VAT check result, with two buttons. That is the whole feature. Approving should do four things atomically:
- 1Remove pending-approval.
- 2Add the access tag your locks check for, such as wholesale or approved-trade.
- 3Stamp an approved_at metafield so you can report on turnaround time.
- 4Send the welcome email.
Because access is tag-driven, approval takes effect on the buyer's next page load. No re-login, no cache to clear, no theme change. Revoking works identically in reverse, which is the reason to prefer tags over anything bespoke.
The welcome email
Short and functional. Confirm they are approved, link directly to the trade collection rather than the homepage, state the minimum order value and the payment terms if any, and give a human name to reply to. Skip the brand story. They already applied.
Why apps cannot add fields to Shopify's own registration form
This question comes up in every wholesale app review, usually as a complaint, so here is the honest technical answer.
Shopify's account pages, and in particular new customer accounts, are served by Shopify, not by your theme. Apps have no injection point into the login or registration form, and the classic /account/register form only accepts the fields Shopify defines. Anything else is discarded on the way through. This is a deliberate security boundary around credentials, and no app can work around it.
That leaves three real options:
| Approach | How it works | Trade-off |
|---|---|---|
| App-hosted form on your storefront | Rendered through the app proxy at a path like /apps/trade-application, styled by your theme | A separate URL from /account/register, so you must link to it clearly |
| Note attributes on Shopify's form | Extra inputs named note[company] submitted with registration | Unstructured, hard to query, no validation, easy to lose |
| A custom page with a form app | Any form builder, then manual account creation | No customer record until someone does it by hand |
The first is the only one that produces a clean customer record with structured data. The practical consequence is that your "Apply for wholesale" call to action should point at the application page, and your login page should carry a line linking to it for buyers who arrive at the wrong door.
Everything above is what Prime Lock's registration and approval flow implements: a proxied form under your theme's styles, live VIES validation, metafields with definitions, and a one-click queue that swaps the tag and sends the email.