Hello,
When I use my app as an embedded one, then hmac and other values are appended to my Admin Link, but if I choose the admin link to be opened in a blank page and not as embedded in shopify, then I only get a page_id and store_domain as a query string appended to URL. I want to verify a request coming from that Admin Link in the backend.
Can you please tell me if there is any way that shopify adds hmac to non embedded app?
Thank you very much in advance !
As far as I know, the requests need to be sent through Shopify in order to append the HMAC signature and whatnot to the request headers. For example, in our Shopify web store I have some methods that send out requests to my middleware server for data via an app proxy. Same with embedded Shopify POS add-ins we have. In either case I validate those requests via the HMAC signature that Shopify is sending. But Shopify has to be the sender I believe. If Shopify isn’t the sender then those header specifics aren’t present.
Thanks for your reply.
When I change settings and set app as embedded to shopify then I get all parameters I need, But if I disable my app to be embedded then admin links are opened in new tab without parameteres that does not let me to verify the request.