Authentication issue

Authentication & Access
1

I am using remix for app dev, I tried building new app, still I am getting the same response.

image
image895×265 29 KB

Request {
18:30:29 │ remix │ method: ‘GET’,
18:30:29 │ remix │ url:
‘http://c74e-2405-201-8022-409c-582c-d29e-851d-61bd.ngrok-free.app/app?dev-console=show&embedded=1&hmac=cfb89be0ee0829ba5ccf847e6b339b6dca271c77
bd5dd90744d9e2a50df6e421&host=YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvZGV2LXN0b3JlLWhsdmVnZW1v&id_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ
odHRwczpcL1wvZGV2LXN0b3JlLWhsdmVnZW1vLm15c2hvcGlmeS5jb21cL2FkbWluIiwiZGVzdCI6Imh0dHBzOlwvXC9kZXYtc3RvcmUtaGx2ZWdlbW8ubXlzaG9waWZ5LmNvbSIsImF1ZCI
6IjUzN2E3ODI1YzUyZWIwOTU3MzFlYjg1MTcwZTIwNDI5Iiwic3ViIjoiMTIyNDA5ODQ0OTI5IiwiZXhwIjoxNzg1MzMwMDg3LCJuYmYiOjE3ODUzMzAwMjcsImlhdCI6MTc4NTMzMDAyNyw
ianRpIjoiMDRjYmJlM2UtNzE5NC00NjAyLWFiNWItNDQ1MWU3YzY5NmJkIiwic2lkIjoiNTRmMGI4YjItOTIzZS00NjU5LWJhY2YtOWJjMTk3ZGU5NDFlIiwic2lnIjoiMWNlNmQ1YmVhNDA
xYjg4MzcyNGYyNjkwMDVjYzkwNGNiMDUzNjhlYTUzZWU2Y2ZjMTgxMGE1Nzk0NjQwZjY1YSJ9.WaVH56efMR7mf3YrtLvjqlF_IHR4e7NDMP4qrkywQ5Y&locale=en&session=9cc554fc
ed861ae49edb31907dddcbda254181f01cca2cc85007d18ab0384c7f&shop=dev-store-hlvegemo.myshopify.com&timestamp=1785330027’,
18:30:29 │ remix │ headers: Headers {
18:30:29 │ remix │ host: ‘c74e-2405-201-8022-409c-582c-d29e-851d-61bd.ngrok-free.app’,
18:30:29 │ remix │ ‘user-agent’: ‘Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/150.0.0.0 Safari/537.36’,
18:30:29 │ remix │ accept:
‘text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8’,
18:30:29 │ remix │ ‘accept-encoding’: ‘gzip, deflate, br, zstd’,
18:30:29 │ remix │ ‘accept-language’: ‘en-US,en;q=0.9’,
18:30:29 │ remix │ cookie: ‘abuse_interstitial=c74e-2405-201-8022-409c-582c-d29e-851d-61bd.ngrok-free.app’,
18:30:29 │ remix │ priority: ‘u=0, i’,
18:30:29 │ remix │ referer: ‘https://admin.shopify.com/’,
18:30:29 │ remix │ ‘sec-ch-ua’: ‘“Not;A=Brand”;v=“8”, “Chromium”;v=“150”, “Brave”;v=“150”’,
18:30:29 │ remix │ ‘sec-ch-ua-mobile’: ‘?0’,
18:30:29 │ remix │ ‘sec-ch-ua-platform’: ‘“Linux”’,
18:30:29 │ remix │ ‘sec-fetch-dest’: ‘iframe’,
18:30:29 │ remix │ ‘sec-fetch-mode’: ‘navigate’,
18:30:29 │ remix │ ‘sec-fetch-site’: ‘cross-site’,
18:30:29 │ remix │ ‘sec-fetch-storage-access’: ‘none’,
18:30:29 │ remix │ ‘sec-gpc’: ‘1’,
18:30:29 │ remix │ ‘upgrade-insecure-requests’: ‘1’,
18:30:29 │ remix │ ‘x-forwarded-for’: ‘2405:201:8022:409c:582c:d29e:851d:61bd’,
18:30:29 │ remix │ ‘x-forwarded-host’: ‘c74e-2405-201-8022-409c-582c-d29e-851d-61bd.ngrok-free.app’,
18:30:29 │ remix │ ‘x-forwarded-proto’: ‘https’,
18:30:29 │ remix │ connection: ‘close’
18:30:29 │ remix │ },
18:30:29 │ remix │ destination: ‘’,
18:30:29 │ remix │ referrer: ‘about:client’,
18:30:29 │ remix │ referrerPolicy: ‘’,
18:30:29 │ remix │ mode: ‘cors’,
18:30:29 │ remix │ credentials: ‘same-origin’,
18:30:29 │ remix │ cache: ‘default’,
18:30:29 │ remix │ redirect: ‘follow’,
18:30:29 │ remix │ integrity: ‘’,
18:30:29 │ remix │ keepalive: false,
18:30:29 │ remix │ isReloadNavigation: false,
18:30:29 │ remix │ isHistoryNavigation: false,
18:30:29 │ remix │ signal: AbortSignal { aborted: false }
18:30:29 │ remix │ }
18:30:29 │ remix │ [shopify-app/INFO] Authenticating admin request | {shop: dev-store-hlvegemo.myshopify.com}
18:30:29 │ remix │ [shopify-app/INFO] Authenticating admin request | {shop: dev-store-hlvegemo.myshopify.com}
18:30:29 │ remix │ Admin client session shop: undefined scopes: undefined
18:30:30 │ remix │ Something went wrong Response {
18:30:30 │ remix │ status: 403,
18:30:30 │ remix │ statusText: ‘’,
18:30:30 │ remix │ headers: Headers { ‘Content-Type’: ‘application/json; charset=utf-8’ },
18:30:30 │ remix │ body: ReadableStream { locked: false, state: ‘readable’, supportsBYOB: true },
18:30:30 │ remix │ bodyUsed: false,
18:30:30 │ remix │ ok: false,
18:30:30 │ remix │ redirected: false,
18:30:30 │ remix │ type: ‘default’,
18:30:30 │ remix │ url: ‘’
18:30:30 │ remix │ }

2

Hey @Samir_Hembrom, thanks for reaching out! I looks like the session there isn’t nested under admin. Could you update this to:

const { admin, session } = await authenticate.admin(request);
console.log(session.shop, session.scope, session.expires);

Since authentication completes before the 403, could you also confirm:

  • Your @shopify/shopify-app-remix version
  • Whether this is a public app created after April 1, 2026
  • Whether future.expiringOfflineAccessTokens: true is enabled

If applicable, update Remix to 4.1+, update your session storage for refresh-token fields, then reinstall the app on the development store. If it still fails, share the failing GraphQL operation and response body or x-request-id, without any tokens.

I’d also redact the full request URL and id_token from your original post if you can. Let me know what you find!

3

I updated from shopify/shopify-app-remix to @shopify/shopify-app-react-router everything seems to be working for now. I cannot edit the post.

4

Thanks for letting us know, @Samir_Hembrom. I believe once threads are solved they can’t be edited, but let me know if I can assist with anything on our end here.