Shopify app authorization gets stuck in an infinite redirect

Authentication & Access
9

Hi, sorry for the late reply. Thank you all for your help. I tried to fix the problem without changing the old flow, but it seemed hopeless. So instead of using authenticate.admin in the auth.callback.jsx file, I manually requested the access token by following this document.

Here’s my current flow:

  1. Receive the /auth/callback request
  2. Validate that the nonce matches the state, and verify the HMAC and shop
  3. Exchange the authorization code for an access token
  4. Set two cookies in the response header: shopify_app_session and shopify_app_session.sig
  5. Return res.redirect with shop and host params

All the steps above follow the docs, except for step 4. It took me quite some time to realize that I needed to set those two cookies in the response header to complete the OAuth flow. I wasn’t sure how Shopify originally created shopify_app_session.sig, and had to do some guesswork to figure it out.

I think the documentation doesn’t mention that step because it assumes the reader is implementing the OAuth flow manually from start to finish—whereas in my case, I only implemented the /callback part manually.