Hi @Uwe_Peukert
The automated embedded app checker works by making a plain HTTP request (like curl) to the App URL configured in your Partners Dashboard and parsing the raw HTML response. It doesn’t execute JavaScript — so the <meta name="shopify-api-key"> tag and the <script src="https://cdn.shopify.com/shopifycloud/app-bridge.js"></script> tag must be present in the server-rendered HTML.
The most common reason this fails with serverless setups is that the endpoint redirects unauthenticated requests (e.g., to an OAuth flow) instead of returning the page directly. Run curl -s https://e-rechnung-app.clever-invoice.com/app | head -50 and confirm both tags are in the output with a 200 status — if the checker gets a redirect or a challenge page, it’ll never see App Bridge.
Your OAuth approach using window.open(authUrl, '_top') suggests you’re using the authorization code grant flow, which introduces redirects that can trip up the checker. The recommended approach for embedded apps is now token exchange combined with Shopify managed installation — your app always renders the page with App Bridge first, then uses shopify.idToken() to get a session token, and your backend exchanges that for an API access token. No redirects needed, and the checker sees a clean HTML page with App Bridge on first load every time.
For your serverless setup specifically, also check whether Vercel’s bot protection or any edge middleware is intercepting the checker’s request before it reaches your function. Other developers behind Cloudflare have hit this exact issue (related thread). Try temporarily disabling any protection on your /app routes and see if the check passes. Let me know what the curl output looks like and we can go from there!