How to pass "Embedded app checks" (App Bridge and Session Tokens) in Partner Dashboard?

Technical Q&A
1

Hi everyone,

I am developing an embedded Shopify app using JavaScript and React. My app works perfectly on my development store, but the Partner Dashboard is still showing the “Embedded app checks” as incomplete.

The dashboard says: “Auto-checked every 2 hours. Log in and interact with your app on a dev store to generate session data.”

I have logged into my development store, opened the app, and clicked around multiple times to generate network traffic, but the following two checks are still pending even after waiting for a few hours:

Using the latest App Bridge script loaded from Shopify’s CDN

Using session tokens for user authentication

To give you more context on what I’ve investigated so far:

  1. App Bridge CDN Check:
    I have integrated the App Bridge CDN. When I test the app in the store, open Chrome DevTools, and inspect the Network tab, I can clearly see the App Bridge script loading successfully from Shopify’s CDN. However, the dashboard check still won’t pass.

  2. Session Tokens Check:
    I completely cleared all old tokens from my database. When I reinstall the app, a new token is generated correctly. I have debugged my code extensively, and I can verify that the correct session token is being passed smoothly without any issues. Every other requirement in my App Listing is approved, but these two checks remain pending.

  3. API Health Warning (Fix Overdue):
    Additionally, I have had this warning in my Partner Dashboard for the last 3 weeks:
    (Note to reader: Please see the attached screenshot showing “Fix overdue: Calls made with deprecated offline tokens detected in the last 14 days”)

I have thoroughly reviewed the Offline Access Tokens documentation, and I don’t see anything wrong with my implementation. Is it possible that this warning is preventing the embedded app checks from passing?

How exactly does Shopify validate these two specific checks behind the scenes? >
What specific network request, header, or payload is the automated system looking for to mark them as approved? I have tried absolutely everything but cannot get past this hurdle. If I can understand the exact technical validation mechanism Shopify uses, I might be able to pinpoint what I am missing.

Any guidance, insights, or pointers would be incredibly appreciated. Thank you in advance!

2

A few things worth separating here, because the Partner Dashboard checks and the API health warning are distinct problems that probably feel connected but aren’t.

The “Fix overdue” offline token warning

This one is almost certainly worth fixing first. Shopify flags stores that are still making calls with deprecated offline tokens. The warning won’t directly block the embedded checks, but if your app is still using offline tokens for user-facing interactions it’s a strong signal that something in your auth flow is wrong in a way that will affect the session token check too.

Offline tokens are meant for background jobs only (webhooks, scheduled syncs). For anything triggered by a merchant action inside the embedded app, you need an online token obtained via App Bridge.

The App Bridge CDN check

This check isn’t just “does the script load?” Shopify’s automated scanner is looking for a specific script tag pointing to https://cdn.shopify.com/shopifycloud/app-bridge.js (or the versioned equivalent) in the HTML that’s served when the app is loaded inside the admin iframe. If your app serves a React SPA, the scanner needs to be able to see that script in the initial HTML response, not added dynamically after hydration.

Double-check that the App Bridge script tag is in your index.html (or server-rendered HTML), not inserted via JavaScript after the page loads.

The session token check

Shopify is looking for calls from your app’s frontend to your own backend that include a valid session token in the Authorization: Bearer <token> header. The token itself comes from App Bridge’s getSessionToken() (or the equivalent hook in the Remix/React template).

The automated check inspects whether your app makes authenticated requests to your own backend using that header during a normal interaction. If you’re currently passing tokens differently (query param, cookie, custom header), the check won’t pass even if your app works fine.

The most reliable fix: use the official Remix template

Shopify’s CLI Remix app template wires all of this up correctly out of the box: App Bridge loaded from CDN, session token exchange via authenticate.admin() on the server, and online tokens for embedded interactions. If you’re hand-rolling this in a standalone React app it’s easy to get 90% right and fail the automated scanner on the remaining 10%.

3

Thank you very much for sharing