My app ShelfShot (app ID 395454021633, client ID 4523fee714d582d1065e8b827217746c) has been blocked from App Store submission for over 48 hours by the two automated Embedded app checks (“Using the latest App Bridge script loaded from Shopify’s CDN” and “Using session tokens for user authentication”).
Setup: official shopify-app-remix v4.2.1 stack. app-bridge.js is loaded from cdn.shopify.com/shopifycloud/app-bridge.js as the first script in the head of every embedded page, with the api key meta tag. All requests authenticate with session tokens (Authorization: Bearer headers, validated server-side on every route).
Verified in the browser on my dev store (jwum-jeokklid.myshopify.com): window.shopify is initialized, app-bridge.js loads from the CDN in the Network tab, and every API request carries the Bearer session token. I have interacted with the app extensively across multiple days, including a subscription to a plan and long-running bulk operations. The app is hosted on Vercel with no bot protection or WAF rules; the app URL responds 200 to all user agents, and there is no robots.txt blocking.
Could someone take a look or manually verify? Happy to provide logs or screenshots.