`shopify.auth.callback` fails in Shopify's app automated verification because cookies are not preserved

[bioub]

Issue summary

Before opening this issue, I have:

• Upgraded to the latest version of the relevant packages
  • @shopify/shopify-api package and version: 12.0.0
  • Node version: v20.14.0
  • Operating system: macOS
• Set { logger: { level: LogSeverity.Debug } } in my configuration
• Found a reliable way to reproduce the problem that indicates it's a problem with the package
• Looked for similar issues in this repository
• Checked that this isn't an issue with a Shopify API

---

Expected behavior

The call to shopify.auth.callback should be able to rely on the state parameter from the URL when the shopify_app_state cookie is missing (e.g., in Shopify’s automated verification environment, which does not handle cookies).

This would allow the OAuth flow to work both in production and in the automated verification environment.

---

Actual behavior

• In production/local development with a real browser, everything works correctly because the cookie is preserved.
• In Shopify’s automated verification environment, the cookie is not preserved between /api/auth/shopify and /api/auth/shopify/callback.

Result:

• The shopify_app_state cookie is set on /api/auth/shopify.
• At the callback, the cookie is missing (Parsed cookies: {}).
• The shopify.auth.callback method throws a CookieNotFound error.

---

Steps to reproduce the problem

Submit an shopify application for production :

---

Debug logs

Cannot complete OAuth process. Could not find an OAuth cookie for shop url: xbbf0y-vp.myshopify.com

[bioub]

IMHO the issue seems to stem from the automated verification script, which historically should handle cookies. However, Shopify Support does not share this view :

[bioub]

The code to update here :
https://github.com/Shopify/shopify-app-js/blob/3e8bd80e26b0a41fd045c19031df795b84b64283/packages/apps/shopify-api/lib/auth/oauth/oauth.ts#L167C5-L175C6

[byrichardpowell]

Hey @bioub 👋

Thanks for reporting this issue, and sorry you are having friction here.

We'll dig into what's happening here and what the correct solution is, then get back to you.

Richard

[byrichardpowell]

Hey @bioub please do you have the App ID that failed the check?

[github-actions]

We're labeling this issue as stale because there hasn't been any activity on it for 60 days. While the issue will stay open and we hope to resolve it, this helps us prioritize community requests.

You can add a comment to remove the label if it's still relevant, and we can re-evaluate it.