OAuth popup rejected, iframe blocked: What flow does Shopify expect under 2.2.2?

Shopify App Store
1

Hi Shopify team,

we operate an established public accounting connector listed in the Shopify App Store. A recent app quality check flagged our account connection flow because the third-party OAuth authorization opens in an auto-closing popup.

The reviewer stated:

“The app cannot have a UI that takes you off the admin via 1 click or ask to log-in.”

This is not an additional login for our Shopify app, nor does it open a standalone version of our application. The separate window contains only the accounting provider’s login and OAuth consent pages. After authorization, it closes automatically and the merchant continues inside the embedded Shopify app.

We understand Shopify’s guidance against popups for essential functionality and are prepared to replace the popup:

However, the provider currently prevents its authentication pages from being embedded:

X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'

An App Bridge modal therefore cannot display this flow. Shopify’s Navigation API documents top-level navigation to an external URL:

open(authorizationUrl, '_top')

Shopify staff have also confirmed that valid test credentials must be provided when an app integrates with a third-party platform. External provider authentication therefore appears to be an expected review scenario:

Can Shopify confirm whether a same-tab top-level redirect to the provider, followed by a return to the embedded app after authorization, complies with requirement 2.2.2?

If so, does the instruction that an app must not “ask to log in” refer only to an additional login for the app itself, rather than the required authentication of a third-party service being connected?

If a top-level redirect is also considered non-compliant, which supported implementation should connector apps use when the OAuth provider prohibits iframe embedding?

We are ready to change the implementation, but need to avoid replacing one rejected flow with another. Our enforcement timeline begins on September 2, so clarification from Shopify staff would be greatly appreciated.

Thank you!

2

Hey @RienNeVaPlus - thanks for flagging this and for laying out the constraints clearly.

I can see the distinction between an additional login for the app itself and authentication with the accounting provider being connected. Since the provider blocks framing, an App Bridge modal wouldn’t be viable here.

I don’t want to give you a definitive interpretation of 2.2.2 without confirming how App Review applies it to this specific case. Could you share the provider involved, and a short recording of the full connection flow? Please keep any app-specific details private through Partner Support.

A merchant-initiated top-level redirect, followed by an immediate return to the embedded app, is documented by the Navigation API: Navigation API. That alone doesn’t confirm review compliance, so I’ll check the expectation on our end and loop back here once I hear back from you.

3

Hi @Alan_G,

thank you.

I’ve now provided the provider name, complete unedited recording, and existing App Excellence case details privately through Partner Support, as requested. The support submission includes a link to this thread.

Please let me know if any additional information is needed.

Thank you again for looking into this.

4

Hey @RienNeVaPlus - no worries! Just confirming that this looks like it’s been escalated by my colleague Rob. I’d direct any further questions there as a first step, but let me know if I can help out further here.

5

Hi @Alan_G,

thank you again. Following your suggestion, we continued our app-specific case through Partner Support.

App Review has now confirmed that a popup, separate browser tab, and top-level redirect to a provider-hosted login are all incompatible with an otherwise embedded app. The only options given were a fully embedded or fully non-embedded app.

We also exhausted the provider-side alternatives. The provider will not permit its OAuth login to be framed and offers no supported alternative authorization method.

The only path presented to us is therefore moving the entire app outside Shopify Admin.

Shopify’s “Embed your app” FAQ distinguishes authentication with an external service from an additional app login, but does not specify a permitted browser context when the provider prohibits framing:

From a merchant-experience perspective, moving all routine workflows outside Shopify Admin because of a provider-controlled authorization step used only during initial connection or rare reauthorization would reduce the embedded experience that requirement 2.2.2 is intended to protect.

Our app-specific remediation remains with Partner Support. However, the underlying question extends beyond our case, since the same constraint can arise for any connector whose provider requires OAuth and prohibits framing.

Could Shopify confirm whether becoming fully non-embedded is the general expectation in that situation?

Thank you