URGENT [API] Invalid API key or access token

[RomainGross]

Hello Community,

I come to you today about an incomprehensible problem who's block my app store submitting ( since 1week + )

To simplify, the Uninstall Shopify WebHook call my URL with GET : url.com/rgpd/appUninstall?shop=myShop.myshopify.com

-> When this URL is call by Shopify webHook when user click on uninstall app on backoffice, it give me a :

I have an error on API call : {"errors":"[API] Invalid API key or access token (unrecognized login or wrong password)"} who come only when 

-> When exactly same URL is called manually by navigator : 

All is working perfectly always... 

1. I have put a tracker to see URL called by shopify, it's exactly the same, token too... 

2. The code can work exactly the same because all API data come from our own database

3. When Shopify call, my script work perfectly ( all is removed in our own database, only the API call gives me an [API] Invalid API key or access token. )

Additional info :

- it's a public app on submitting process, so I use public app authentication so ['access_token'] is put in the header : X-Shopify-Access-Token ( with 2oAuth ) -> Maybe they 

- Maybe Shopify want API connexion like private app ? But I will be blocked because I can't have private 'password' of Shopify official test account they use to submit the app.. They use random shop...

- It was working in Mars when I have setup and test the feature... 

- I have find the bug because Shopify Submitting controller aren't able to connect on the app with their special account, who is working for me and other, so I guess it's the same API problem when a call come shopify platform... ? So they aren't able to connect on my application and we can't continue submitting process..

Personal context : 

- I am working on app for a big firm and I am blocked on since 1 week on app store submitting process ( so I am fired by them now and it's very urgent 😕 ). 

- I am a senior Full-Stack dev on Lamp, 1st time since 4y I am blocked on something... I have try anything ... So here I very need help 😄 

- You will really save my life on this point ❤️ 

Thanks in advance,

I remaining at your entire disposal if I can give you more info, or by mail at rgross@outlook.fr

I wish you a nice day 🙂

[N9 · Accepted solution]

Hello RomainGross,

No matter what, if the shopify user receive uninstall webhook (and it's valid), the user has already uninstalled your app, any recurring/subscription charges to your app have been canceled, and you can no longer use their shop's access token. This is why you get an error for Invalid API Key or Access Token - You have no longer access to the user access token.

[RomainGross]

Hi topigra4,

Thanks a lot for your fast anwser !

When you say it, it seems so logic -> so I must handle different way to delete product previously added to my shop. 

So have you an idea on why only Shopify Staff members aren't able to access my application ? ( I have guess it was the same problem, but not definitely )... 

For sample, I have received this small video capture from Shopify Staff : https://screenshot.click/17-26-67593-78353.webm

Of course, all unless Shopify staff success connexion... I am so lost because I can't reproduce the problem... ( maybe they use embed/iframe navigator, I have handle this problem but not working always... ) .. Scope verified and seem ok... 

Thanks a lot again ! 

Romain