Embedded app checks stuck - App Bridge CDN and session tokens not passing after 24+ hours

Shopify App Store
1

My embedded app checks have been pending for 24+ hours. App Bridge CDN script is loaded and shopify-api-key meta tag is present. Requesting manual verification. App: AI SEO Optimizer, Partner ID: 4005052

2

Hey @neel_parikh - thanks for flagging. This should auto-run every two hours or so. To confirm, are you interacting with your app within the embedded iframe inside a shop admin?

If so, and it’s still not tracking that, let me know and I can take a closer look.

3

Hi @Alan_G, yes I am interacting with the app inside the Shopify admin iframe at [admin.shopify.com/store/thfix-test/apps/ai-seo-optimizer-19](http://admin.shopify.com/store/thfix-test/apps/ai-seo-optimizer-19). I’ve been doing this for 48+ hours in regular Chrome with no ad blockers. The checks are still not passing. Could you please take a closer look and manually verify/unblock them? App URL: https://thfix.in, Partner ID: 4005052. Thank you!

4

Hey @neel_parikh - thanks for sharing the example app URL.

I did a little testing, and I think the issue may be, from what I can see, that the app is loading inside the Shopify Admin iframe and the App Bridge CDN script is loading, but what stands out is on the session-token side. From my testing, your frontend requests to api.thfix.in are plain requests using the shop query param, but they don’t include an Authorization: Bearer <session_token> header. The embedded app check is likely looking for your app backend calls to be authenticated with an App Bridge session token, not just for the app to receive the initial embedded launch params if this makes sense. A bit more info on this requirement here.

For example, your frontend fetches should be doing something along these lines:

const token = await window.shopify.idToken();

await fetch("https://api.thfix.in/api/products?shop=thfix-test.myshopify.com", {
  headers: {
    Authorization: `Bearer ${token}`,
  },
});

Then your backend should verify that token before serving the request.

One other thing I noticed: the rendered app shell is loading https://cdn.shopify.com/shopifycloud/app-bridge.js, but I’m not seeing the shopify-api-key meta tag in the HTML.

I’d add that as well and remove any older/manual App Bridge initialization code, since the current CDN setup expects that meta tag to be present.

Once those changes are deployed, reinstall/open the app from the Shopify admin and interact with it for a few minutes. That should give the checks the session-token activity they need to detect. Let me know if that still doesn’t work and I can certainly help take another look. Hope this helps!

5

Hi @Alan_G, I’ve deployed both fixes — added the shopify-api-key meta tag and switched to window.shopify.idToken() for authenticated requests. I’m now interacting with the app on my dev store. Will wait for the next check cycle and update you!

6

Thanks for following up @neel_parikh - I hope this helps! If you’re still seeing issues after the next few days max just ping me here and I can help out further.

7

Hi @Alan_G, I deployed both fixes but window.shopify is still undefined in the console. I’m also seeing this error: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('``https://thfix.in``') does not match the recipient window's origin ('``https://admin.shopify.com``'). It seems App Bridge can’t initialize because of the origin mismatch. The app loads at admin.shopify.com but tries to communicate with thfix.in. Can you advise what’s causing this and how to fix it?

8

Hey @neel_parikh - I took another look and it looks like your frontend bundle still appears to include older/manual App Bridge initialization using window.ShopifyAppBridge.createApp, shopOrigin, and forceRedirect. With the current CDN setup, that manual initialization should be removed and App Bridge should be accessed through the window.shopify global instead. It can see the shopify-api-key meta tag and the App Bridge CDN script though, which is good!

I’d also make sure your app uses one exact canonical origin everywhere. Right now thfix.in appears to redirect to www.thfix.in, but in my console, it seems to reference https://thfix.in. The App URL and redirect URLs in the Partner Dashboard should match the actual origin serving the embedded iframe.

One more thing I’d just double check: make sure your backend rejects requests that don’t include a valid Authorization: Bearer <session token> header before doing any Shopify API work. If window.shopify is undefined, the frontend shouldn’t fall back to plain fetch for app API calls, since that can keep the session-token check from seeing authenticated activity.

Once those changes are deployed, reinstall/open the app from the Shopify admin and interact with it for a few minutes, then give the check another cycle or two. If it’s still stuck after that, I can for sure help dig in further (we can set up a DM and I can take a direct look at your code there!)