Problem with 403 with Billing API

Hello Everyone!

Has anyone seen 403 Forbidden on both billing.check and billing.request for a dev store with otherwise valid embedded auth/session setup?
Is this typically due to Partner Dashboard billing capability state on the app/store pair, and what exact Partner-side checks should be verified to unblock appSubscriptionCreate?

I created a new shopify app and would like to put it for review, but I can’t make plans part working via Billing API (all settings in manage plans are correct, no Managed plans).
This is embedded Shopify app (@GovRayt/shopify-app-react-router, @GovRayt/shopify-api@13.0.0)

I expect billing.request should create a test subscription (appSubscriptionCreate(test: true)), return the Shopify confirmationUrl, the merchant approves, the app receives the return + webhook, and the subscription becomes active.
What I get: billing.request also fails with 403 GraphQL Client: Forbidden and billing.check fails with 403 GraphQL Client: Forbidden.

What we already validated

  • Calls are made using authenticated session token (authenticate.admin(request)), not API key/secret clients.
  • Query paths target currentAppInstallation as expected (including SDK billing check internals).
  • isTest: true is passed in dev.
  • App webhook endpoint is reachable and can receive webhook deliveries.
  • We added dev diagnostics showing full operation/request/error details.
  • 2 hours spent with Shopify support, now the ticket was transfered to Shopify Engineers (I hope)

If Anywone has ideas how to test/fix this, I will appreciate that.

I had thats issue before dont use www just https://andyourwebsitesname.myshopify.com

Not my case, as an issue happens inside admin at https://admin.shopify.com/store/…

Ok, seems I resolved 403. Closing the topic, but my solution was in enabling the expiting tokens (future feature) after reading this: Expiring offline access tokens required for new public apps as of April 1, 2026 - Shopify developer changelog

future: {
expiringOfflineAccessTokens: true,
},

The doc about tokens: About offline access tokens