Bulk action links with standalone app

[matobi]

Hi, I am using bulk action links with an embedded app, and that works fine. But when I change the app to a standalone app, then the hmac value is no longer included in the request. Is that by design?

In shopify.dev/concepts/apps it says that "Standalone apps can’t use app extensions to add features to the Shopify admin or POS". Am I not supposed to use bulk action links with standalone apps?

[Greg_Kujawa · Accepted solution]

The reason you are seeing the HMAC signature through the embedded app's call-out requests is because Shopify is automatically providing it. Seeing that your embedded app is working from within Shopify's framework.

Your standalone app loses that behavior, since you'd need to presumably come up with your own mechanism for providing functionality like this. If you look at the logic behind how it works then you should be able to replicate this fairly easily. Or come up with your own logic to validate inbound requests.