Hi, I am using bulk action links with an embedded app, and that works fine. But when I change the app to a standalone app, then the hmac value is no longer included in the request. Is that by design?
Solved! Go to the solution
This is an accepted solution.
The reason you are seeing the HMAC signature through the embedded app's call-out requests is because Shopify is automatically providing it. Seeing that your embedded app is working from within Shopify's framework.
Your standalone app loses that behavior, since you'd need to presumably come up with your own mechanism for providing functionality like this. If you look at the logic behind how it works then you should be able to replicate this fairly easily. Or come up with your own logic to validate inbound requests.