Both “Embedded app checks” on my app submission page have been pending for over 24 hours and will not turn green, even though the app meets both requirements. Requesting a manual verification.
Using the latest App Bridge script loaded from Shopify’s CDN
Using session tokens for user authentication
App Bridge is loaded from Shopify’s CDN as the FIRST script in , with the shopify-api-key meta tag before it, server-rendered into the initial HTML:
There is exactly one App Bridge script tag on the page. Nothing is bundled and there are no duplicate copies.
Session tokens are used for authentication on every request. Every embedded route calls authenticate.admin(request) from @shopify/shopify-app-react-router/server, which validates the session token that App Bridge attaches to each request. The app loads inside the Shopify admin, navigates between pages, and all admin pages fetch their data successfully.
I have logged in and interacted with the app on my development store several times since deploying this setup, so session data should be present.
Could someone please manually verify these two checks? Happy to provide any further detail or logs.
Hey @simpll! Your App Bridge setup sounds correct. Loading from https://cdn.shopify.com/shopifycloud/app-bridge.js always pulls the latest version, so that requirement is satisfied on the implementation side and nothing needs to change there.
The pending state doesn’t mean the checks ran and failed, or that they’re queued behind a reviewer. It means they haven’t received a signal yet. These checks detect App Bridge activity when the app runs embedded inside the Shopify admin, so if no activity is recorded, both items sit as pending spinners regardless of how correct the code is.
The most common cause is something in the browser or network blocking that telemetry, such as ad blockers, privacy extensions, VPNs, or DNS-level filtering like Pi-hole. Disabling extensions in your usual profile isn’t always enough. A partner on the same shopify-app-react-router stack hit this exact situation and resolved it with a brand-new browser profile in a clean VM, as in this thread. Worth trying that first.
One thing from that thread that’s easy to miss is that an app can work correctly and still not exercise the path the check observes. If you’re only validating the token server-side through authenticate.admin(request), make sure your client-side code is actually calling shopify.idToken() for its requests, and that the shopify-api-key meta tag is in the initial HTML ahead of the App Bridge script rather than injected after it loads. The session token setup guide covers the expected pattern.
If you’ve tried a clean browser and the checks still don’t flip after a couple of hours, follow up here with what you see in the browser Network tab while using the app inside the admin and I can take a closer look - thanks!