Session token check stuck red despite correct App Bridge v4 + session tokens

Shopify App Store
1

Hi,

I’m submitting my app for App Store review and the “Using session tokens for user authentication” embedded app check stays red after multiple 2-hour cycles. The App Bridge CDN check is green.

App: etiqi — Partner ID 4939084, App ID 369332060161
Stack: @shopify/shopify-app-react-router, App Bridge v4 from CDN, hosted on Railway (EU).
Dev store: etiqi-dev.myshopify.com

What I have verified is working:

  • App Bridge script (https://cdn.shopify.com/shopifycloud/app-bridge.js) loads from Shopify’s CDN — confirmed in the Network tab, and the CDN check is green.
  • The shopify-api-key meta tag and the App Bridge script tag are both present in the rendered DOM.
  • Session tokens fire: Authorization: Bearer <jwt> headers are present on fetch requests to my backend. I also added an explicit lightweight /app/ping route that calls authenticate.admin(request) and is hit on app mount using window.shopify.idToken().
  • AppProvider from @shopify/shopify-app-react-router/react is correctly configured in app/routes/app.jsx.
  • The app installs and runs correctly embedded in the Shopify admin iframe; tested with several minutes of multi-page interaction on my dev store.

Importantly, my App URL (https://www.etiqi.app, exactly as configured in the Partners dashboard) returns a clean HTTP 200 to external/non-browser clients — there is NO bot-protection / WAF / challenge page in front of it (Railway, no Cloudflare/Vercel). Here is the curl -sI output the checker would see:

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Date: Mon, 08 Jun 2026 16:41:59 GMT

Server: railway-hikari

vary: Accept-Encoding

x-railway-edge: railway/us-west2

x-railway-request-id: Wm_mtIOPRMKLk–eljLL4A

x-hikari-trace: cdg1.e9jw

Connection: keep-alive

Since the App URL is fully reachable with no bot protection, and session tokens are firing correctly in the browser, could a staff member please manually verify and unblock the session-token check? Happy to provide collaborator access to the dev store. Thanks!

2

Hey @Darryl_BAYA - thanks for the detailed writeup.

I took a quick look at your app and it’s responding with a 502 “Application failed to respond” right now, so I wasn’t able to see the session-token activity the check looks for. While the App URL is 502ing, the embedded app doesn’t load, App Bridge never requests a session token, and there’s no activity for the check to pick up.

For clarity on how the check works: it isn’t reading the curl response or the Bearer headers hitting your backend. It looks at session-token activity recorded through App Bridge in the browser specifically. Once the App URL is responding again, open etiqi embedded in the admin in a normal browser window with all extensions off and click through a few pages so App Bridge fetches a session token a few times. That’s the activity the check records, and it refreshes roughly every 2 hours. If you’re still seeing issues after this, let me know and I can definitely take another look.

Hope this helps!