Does embed app must use session token?

[marv1nnnnn]

Hi everyone, we are developing a new Shopify app and planning to submit it. We noticed that there is a restriction for the embedded app from the Requirements for apps in the Shopify App Store.

Embedded apps that don't use session tokens - Embedded apps submitting to the Shopify App Store must use session tokens to authenticate

Wanna make sure some details:

1. If the app is embedded, is it 100% necessary to use the session token?
2. If the backend does not call the Shopify API, is it still required to use the session token to authenticate?
3. How to check if we meet the requirement or not? I saw some apps got rejected because The app shows an error when the 3rd party cookies are blocked. So if we block the 3rd party cookie locally and the app works well, can we assume it will meet the requirement?

[Henry_Tao · Accepted solution]

Hi @marv1nnnnn 

I think all of your points are correct. Embedded app is highly recommended to use session token if it needs authentication. 

[Henry_Tao]

@marv1nnnnn 

Note that: although it's not required to use app-bridge for some apps but it's recommended to do so. There are a lot of opening questions if you don't: 

- How do you perform auth when your app is loaded inside Shopify (iframe)? 

- How do you make sure the request coming to your server is from Shopify? SessionToken is designed for this purpose. It's not for making a call to Shopify API.

- You also want to make sure your app works well on Shopify Mobile / Shopify POS. See https://shopify.dev/apps/tools/app-bridge/optimized-loading