I think only for the HTML. Since this avoid faking the iframe and point it to another HTML file and display a different app.

You can get it from contract's information. There's a customerPaymentMethod with that info.

I used GQL's customerPaymentMethodSendUpdateEmail call More info at:https://shopify.dev/api/admin-graphql/2022-01/mutations/customerPaymentMethodSendUpdateEmail

Yes, I needed to create a button to generate the email that is sent to the customer to change their payment info

@Sinhaneilyou have to add that in the headers. If you check the http headers on the browser and these values appear, it means that it's ok.

We got our application approved, we needed to reply for each request the requested shop's domain and admin.shopify.com, for example, if example-store.myshopify.com does a request to our app. We reply with: frame-ancestors: example-store.myshopify.com...

Shopify replied me that they want to see only their requested website plus admin.shopify.com. They don't want to see a list of all applications nor wildcards. Just requested shop's domain and admin.shopify.com

I read on slack that wildcards are not supported it must be the exact domain of the store.

I think you need to add also any store that has installed the app. Not only their testing store because they use multiple.

Hello!We added frame-ancestors as required on https://shopify.dev/apps/store/security/iframe-protectionWe return the values https://*.myshopify.com and admin.myshopify.com to ensure that only shopify shops and admin works. But it got reject, do someo...

I've sent the app to shopify and got rejected, I needed to let customers to change payment method for his subcriptions. But they don't give any more information, just this link:https://shopify.dev/apps/store/requirements#a-storefront-requirementsAcco...