Here is my solution:
Initial Steps
1. make the fetch with required billing options in the request body:
`https://${shop}/admin/recurring_application_charges.json`
2. Save the shop and charge_id from the response to my backend database.
3. redirect to the confirmation_url extracted from the response.
Work Around
When the shop owner is presented with the confirmation page and accepts, Shopify redirects to the return_url established earlier, BUT without any credentials (as you mentioned above). This fails verifyRequest middleware and redirects the shop owner to my authentication endpoint.
4. To avoid this I appended the shop and hmac to the return_url in my recurring_appplication_charge json body defined earlier, and I removed verification of the router intercepting requests to return_url in my app. My return url looked something like this:
`https://${return_url}?hmac=${hmac}&shop=${shop}`
5. Redirects to return_url can now get intercepted by the corresponding router. I use the charge_id appended to the query string by Shopify and the shop to identify and update billing state on my backend. I have not yet tried this, but I suppose you can manually verify the request with the using the hmac in the verification string.
7. Once billing state on my backend is taken care of, I use the shop parameter in the query string and the SHOPIFY_API_KEY to redirect the user to my embedded app page.
`https://${shop}/admin/apps/${SHOPIFY_API_KEY}`
Any feedback on this approach would be appreciated.
Lingering Q's
- Why would i be getting a different session ID on the return_url redirect?
- Also, according to the documentation, every request and redirect made by Shopify should include hmac in the query string. Any reason why its not being included with the return_url redirect?
