Hi team, two of our apps have been stuck on the automated “Embedded app checks” (both “latest App Bridge script from Shopify CDN” and “session tokens for user authentication”) for over 24h, blocking submission. Every other pre-submission check is green.
Auth uses session tokens via token exchange (Shopify Remix, new embedded auth strategy). Authenticated Admin GraphQL calls succeed, and both apps render and function embedded on our development store, which we have re-opened and interacted with repeatedly to generate session data.
Partner ID: 5029640
HewnScan - App ID: 393396420609
Findable - App ID: 394078584833
Could you please manually verify that the underlying session data qualifies, or advise what the scanner is not detecting? Happy to provide network captures showing the Authorization: Bearer session tokens. Thanks.
I took a look on our end, and I’m not seeing the qualifying embedded-app signals for those submitted app IDs yet per our logs from what I can see. The main thing to double-check is that you’re testing the exact submitted apps, not a separate CLI/dev app or another Client ID.
Could you try this once more just to narrow things down?
Reinstall/open each app from the dev store Admin, not from a direct app/tunnel URL: admin.shopify.com → dev store → Apps → HewnScan / Findable
Confirm the deployed app config uses the same Client ID/API key shown for that app in Partner Dashboard.
While embedded in Admin, interact with actual app UI for a few minutes: navigate between app pages, click buttons/actions, open any App Bridge-driven UI like modals/toasts/resource pickers if available, and trigger authenticated backend/Admin API requests that send Authorization: Bearer <session_token>.
Wait for the next check cycle, roughly 2 hours.
If both checks are still pending after that, just reply back here with a screenshot or a short recording showing the app being opened from the Admin Apps menu, the admin.shopify.com URL, and the authenticated request/App Bridge CDN load in Network. I’ll get in touch with the team on our end from there and can dig into this for you for sure.
The deployed Client ID/API key matches the Partner Dashboard exactly: HewnScan (393396420609) = 9cd3ae8d3f475ae93e6e6bf77c85afb6, Findable (394078584833) = 7f5f28a112d6e657172b70f8eaa5a5da.
To rule out anything store-specific, I created a brand-new development store (hewnpath-test2.myshopify.com), freshly installed both apps there, and interacted for several minutes each time - including Findable’s “Scan catalog”, which pages through 17 real products and issues authenticated Admin GraphQL calls with Authorization: Bearer . Both apps render and function fully embedded.
app-bridge.js is loaded from https://cdn.shopify.com/shopifycloud/app-bridge.js as the first script in the initial server-rendered (verified via curl on both app URLs), with data-api-key and a tag - exactly per the App Bridge docs.
Despite all this, both “Embedded app checks” have been pending for 3+ days now, blocking submission. Since you mentioned the qualifying signals aren’t reaching your logs even though everything above checks out, could you please loop in the team to see why the signals aren’t being ingested for these App IDs? Happy to send a HAR export or a short screen recording of the embedded load + the Authorization: Bearer request and the app-bridge.js CDN fetch - just let me know the best way to share it. Thanks a lot.
Thanks for the detailed follow-up. I checked again and can confirm activity is reaching us for both submitted app IDs on the new development store, appreciate you installing/re-installing.
Could you send a short recording and redacted HAR showing the embedded document URL, the shopify-api-key meta tag and CDN script in the loaded response, one App Bridge action, and one authenticated browser-to-backend request? If you’d prefer to send that via DM, I can set that up on my end, since I definitely realize some of that info is private.
Once I have that, I’ll pass this along so the team can investigate why the embedded-app signals aren’t being attributed. These checks can’t be manually passed from our side, but this should let us separate a runtime configuration issue from a telemetry problem.
Resolved, thanks Alan. It was browser-side: a tracker blocker (uBlock Origin Lite / EasyPrivacy) was blocking the App Bridge telemetry POSTs to monorail-edge.shopifysvc.com (503), so the signals never reached you even though App Bridge + session tokens were fine. Disabled it, the beacons went 200, and both embedded checks went green within ~30 min. Both apps are now submitted, so no HAR needed. Thanks for digging in.