Shopify doesn't recognise that my app uses session tokens

Authentication & Access
1

My Shopify app is ready to submit except the automated checks in the Partner dashboard don’t recognise that it uses session tokens.

SCR-20250109-bjl
SCR-20250109-bjl691×820 49 KB

My app is based on the Node.js template but with some updates. I use App Bridge on the frontend but I only use the built in fetch method, I never directly use the session tokens because I have no need for it. It says in the documentation that these are automatically authenticated when using App Bridge.

I’ve inspected my requests and they do indeed show session tokens.

Below are some snippets from my app code:

Frontend index.js:

import createApp from “@shopify/app-bridge”;
import {getSessionToken} from “@shopify/app-bridge/utilities”;

const app = createApp({
apiKey: import.meta.env.VITE_SHOPIFY_API_KEY,
host: new URLSearchParams(window.location.search).get(“host”)
});

// I’ve added this to try and force it to use a session token, hoping it would then recognise it
(async () => {
try {
// Initialize i18n
await initI18n();

// Fetch session token
const sessionToken = await getSessionToken(app);

// Render the app
const root = createRoot(document.getElementById("app"));
root.render(<App />);

} catch (error) {
console.error(“Error during initialization:”, error);
}
})();

Component on the app page:

import {useAppBridge} from “@shopify/app-bridge-react”;
[…]
import {useQuery} from “react-query”;

export function OrdersCard() {
const shopify = useAppBridge();

[...]
const {
    data: orders,
    refetch: refetchOrders,
    isLoading: isLoadingOrders,
    isRefetching: isRefetchingOrders,
} = useQuery({
    queryKey: ["orders"],
    queryFn: async () => {
        const response = await fetch("/api/orders");
        return await response.json();
    },
    refetchOnWindowFocus: false,
});

** backend initialisation

import {shopifyApp} from “@shopify/shopify-app-express”;
[…]

const shopify = shopifyApp({
useOnlineTokens: true,
api: {
apiVersion: LATEST_API_VERSION,
restResources,
billing: billingConfig,
},
auth: {
path: “/api/auth”,
callbackPath: “/api/auth/callback”,
},
webhooks: {
path: “/api/webhooks”,
},
sessionStorage: new PostgreSQLSessionStorage(DATABASE),
});

export default shopify;

I should add that I followed this guide to migrate to the newest version of @shopify/app-bridge-react. Migrate your app to Shopify App Bridge React 4.x.x

I even have another app that’s based on the same exact structure - it’s already approved and was approved before this automated check for session tokens came into effect. But for this one it even confirms in the app dashboard that session tokens are being used.

image
image664×248 22.8 KB

So what am I missing here or how can I make it recognise the use of session tokens?

I’d love to get this app out there as it has proven need for it.

2

Hi @Michelle_Retzlaff is your app and embedded app? If yes then you need to use app-bridge. If not check your settings you must have enabled " Embedded in Shopify admin" as true. If its true mark it false and you will be able to submit app for review.

3

Yes, it’s an embedded app, and yes it uses App Bridge already.

4

Hi! Can you link to the documentation you’re referring to here? Thanks!

1 Like
5

It says so under “useAuthenticatedFetch” in “Other hooks”. We are also currently experiencing this issue with our app. Use AppBridge v4 with the header script and the built in fetch function.

I have confirmed that all network calls made to the backend has the appropriate auth headers, and that getSessionToken is being called when tokens expire.

6

@Mike_Ragalie Here’s the link to the latest v4 AppBridge guide for the pre-authenticated fetch: Resource Fetching

It’s linked from the v4 AppBridge migration guide section Other Hooks: Migrate your app to Shopify App Bridge React 4.x.x

7

Ok good, I’m glad you’re all seeing a valid session token in the Authorization header. It’s not great but certainly better for us to have a bug in the App Store review tooling than in the merchant-facing logic.

I’m going to get this in front of the team who best knows the App Store review stuff and see if we can figure out what’s going on.

Thanks for the report, stay tuned.

8

Hi @Michelle_Retzlaff from what I can see, this has been resolved?

9

Yes, thank you all, it’s been resolved. It ended up recognising it a few days later. I’m not sure if it just takes this long or if something was changed on Shopify’s end, but I’m happy it came through.

My app is live now, which is great!

1 Like