Public app submission is blocked: the two “Embedded app checks” (“latest App Bridge script from the CDN” and “session tokens for user authentication”) won’t turn green, so Submit for review stays disabled.
Stack: @shopify/shopify-app-remix 3.4, @shopify/app-bridge-react 4.1.5, unstable_newEmbeddedAuthStrategy (token exchange), zero access scopes.
Verified: App Bridge loads straight from cdn.shopify.com/shopifycloud/app-bridge.js via AppProvider (nothing bundled/self-hosted), auth is session-token based (not cookies), telemetry beacons fire on load, and I’ve used the app on a dev store across 3+ full 2-hour cycles. Both checks still spinning.
My main question: could the ZERO-scope setup be why the “session tokens” check never satisfies? The app never calls the Admin API, so Shopify may never observe a session token used against its APIs, only against my own backend. If so, what’s the recommended way to pass this check for a scopeless app?
Also: has anyone cleared these checks, and is there any way to force a re-evaluation vs waiting on the 2-hour batch? Thanks!