[Bug]: Session Token Validation Fails After Migrating SvelteKit App to Remix

[donheshanthaka]

Please confirm that you have:

• Searched existing issues to see if your issue is a duplicate. (If you’ve found a duplicate issue, feel free to add additional information in a comment on it.)
• Reproduced the issue in the latest CLI version.

In which of these areas are you experiencing a problem?

App

Expected behavior

When linking a previously created Shopify embedded app (originally built with SvelteKit) to a newly scaffolded Remix app using the Shopify CLI, the session token validation should work as it does with newly created apps. This should allow migration of existing apps without breaking authentication.

Actual behavior

• After linking an existing SvelteKit app (migrated to Remix) to the new Remix app, session token validation fails in the embedded Shopify environment.

• To confirm that my migration approach was correct, I created a brand-new Shopify app and linked it to the same Remix codebase — in this case, session token validation worked as expected.

• This suggests the issue only occurs when the linked app was originally created as a SvelteKit app, even though the configuration parameters match the working setup.

Verbose output

Verbose output

August 11, 2025 at 11:27
🔍 [AUTH] authenticate.admin called
-
August 11, 2025 at 11:27
🔍 [AUTH] Request URL: http://ecommerce-frontend.1courier-test.com/auth/session-token?embedded=1&hmac=052f798e2fbb88f8e1bcb0174179d3e414a88a0ebb08c443f7d58b5f8114aa39&host=YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvdGVzdC1zdG9yZS0yMjIyMDAw&locale=en&session=24cd2c72acc4ae8d6207323385ce6ddef395d7d578a60aad403f1e3e1af5c923&shop=test-store-2222000.myshopify.com&timestamp=1754891834&shopify-reload=https%3A%2F%2Fecommerce-frontend.1courier-test.com%2Fapp%3Fembedded%3D1%26hmac%3D052f798e2fbb88f8e1bcb0174179d3e414a88a0ebb08c443f7d58b5f8114aa39%26host%3DYWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvdGVzdC1zdG9yZS0yMjIyMDAw%26locale%3Den%26session%3D24cd2c72acc4ae8d6207323385ce6ddef395d7d578a60aad403f1e3e1af5c923%26shop%3Dtest-store-2222000.myshopify.com%26timestamp%3D1754891834
-
August 11, 2025 at 11:27
🔍 [AUTH] Request method: GET
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Rendering bounce page | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Authenticate returned a response | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
GET /auth/session-token?embedded=1&hmac=052f798e2fbb88f8e1bcb0174179d3e414a88a0ebb08c443f7d58b5f8114aa39&host=YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvdGVzdC1zdG9yZS0yMjIyMDAw&locale=en&session=24cd2c72acc4ae8d6207323385ce6ddef395d7d578a60aad403f1e3e1af5c923&shop=test-store-2222000.myshopify.com&timestamp=1754891834&shopify-reload=https%3A%2F%2Fecommerce-frontend.1courier-test.com%2Fapp%3Fembedded%3D1%26hmac%3D052f798e2fbb88f8e1bcb0174179d3e414a88a0ebb08c443f7d58b5f8114aa39%26host%3DYWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvdGVzdC1zdG9yZS0yMjIyMDAw%26locale%3Den%26session%3D24cd2c72acc4ae8d6207323385ce6ddef395d7d578a60aad403f1e3e1af5c923%26shop%3Dtest-store-2222000.myshopify.com%26timestamp%3D1754891834 200 - - 1.939 ms
-
August 11, 2025 at 11:27
GET /app?embedded=1&hmac=052f798e2fbb88f8e1bcb0174179d3e414a88a0ebb08c443f7d58b5f8114aa39&host=YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvdGVzdC1zdG9yZS0yMjIyMDAw&id_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczpcL1wvdGVzdC1zdG9yZS0yMjIyMDAwLm15c2hvcGlmeS5jb21cL2FkbWluIiwiZGVzdCI6Imh0dHBzOlwvXC90ZXN0LXN0b3JlLTIyMjIwMDAubXlzaG9waWZ5LmNvbSIsImF1ZCI6ImRmMTFiOGVlYzIzMWEzYzMyYzE5OTBlZmZkMWU5MGU4Iiwic3ViIjoiODA1ODc4NDk4ODQiLCJleHAiOjE3NTQ4OTE4OTQsIm5iZiI6MTc1NDg5MTgzNCwiaWF0IjoxNzU0ODkxODM0LCJqdGkiOiJhYjgxZGQ2Mi02YjE1LTRmM2EtYmRkNy1hMWZiMGI5MTk1ODciLCJzaWQiOiI1MWNkMjliMy0xMDE5LTRiYzctOTYzMS02Mjg0OTdhZTllNjEiLCJzaWciOiI1ODUxNGFiNTI3OWUxMGI4MTFkNjUzYWY2YmI3ZGZkNWZlMDM5YTE3N2FhNTI2Nzg5NjIyOWVjM2Q1YTBiODNlIn0.6DOOFNbi_NyPEKbBMmzpWc5uw-DbF5U_fsr6Gp3CWzo&locale=en&session=24cd2c72acc4ae8d6207323385ce6ddef395d7d578a60aad403f1e3e1af5c923&shop=test-store-2222000.myshopify.com&timestamp=1754891834 302 - - 8.819 ms
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Failed to validate session token: Failed to parse session token 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczpcL1wvdGVzdC1zdG9yZS0yMjIyMDAwLm15c2hvcGlmeS5jb21cL2FkbWluIiwiZGVzdCI6Imh0dHBzOlwvXC90ZXN0LXN0b3JlLTIyMjIwMDAubXlzaG9waWZ5LmNvbSIsImF1ZCI6ImRmMTFiOGVlYzIzMWEzYzMyYzE5OTBlZmZkMWU5MGU4Iiwic3ViIjoiODA1ODc4NDk4ODQiLCJleHAiOjE3NTQ4OTE4OTQsIm5iZiI6MTc1NDg5MTgzNCwiaWF0IjoxNzU0ODkxODM0LCJqdGkiOiJhYjgxZGQ2Mi02YjE1LTRmM2EtYmRkNy1hMWZiMGI5MTk1ODciLCJzaWQiOiI1MWNkMjliMy0xMDE5LTRiYzctOTYzMS02Mjg0OTdhZTllNjEiLCJzaWciOiI1ODUxNGFiNTI3OWUxMGI4MTFkNjUzYWY2YmI3ZGZkNWZlMDM5YTE3N2FhNTI2Nzg5NjIyOWVjM2Q1YTBiODNlIn0.6DOOFNbi_NyPEKbBMmzpWc5uw-DbF5U_fsr6Gp3CWzo': signature verification failed | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Authenticate returned a response | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Authenticate returned a response | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Attempting to authenticate session token | {shop: test-store-2222000.myshopify.com, sessionToken: {"search":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczpcL1wvdGVzdC1zdG9yZS0yMjIyMDAwLm15c2hvcGlmeS5jb21cL2FkbWluIiwiZGVzdCI6Imh0dHBzOlwvXC90ZXN0LXN0b3JlLTIyMjIwMDAubXlzaG9waWZ5LmNvbSIsImF1ZCI6ImRmMTFiOGVlYzIzMWEzYzMyYzE5OTBlZmZkMWU5MGU4Iiwic3ViIjoiODA1ODc4NDk4ODQiLCJleHAiOjE3NTQ4OTE4OTQsIm5iZiI6MTc1NDg5MTgzNCwiaWF0IjoxNzU0ODkxODM0LCJqdGkiOiJhYjgxZGQ2Mi02YjE1LTRmM2EtYmRkNy1hMWZiMGI5MTk1ODciLCJzaWQiOiI1MWNkMjliMy0xMDE5LTRiYzctOTYzMS02Mjg0OTdhZTllNjEiLCJzaWciOiI1ODUxNGFiNTI3OWUxMGI4MTFkNjUzYWY2YmI3ZGZkNWZlMDM5YTE3N2FhNTI2Nzg5NjIyOWVjM2Q1YTBiODNlIn0.6DOOFNbi_NyPEKbBMmzpWc5uw-DbF5U_fsr6Gp3CWzo"}}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Validating session token | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Failed to validate session token: Failed to parse session token 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczpcL1wvdGVzdC1zdG9yZS0yMjIyMDAwLm15c2hvcGlmeS5jb21cL2FkbWluIiwiZGVzdCI6Imh0dHBzOlwvXC90ZXN0LXN0b3JlLTIyMjIwMDAubXlzaG9waWZ5LmNvbSIsImF1ZCI6ImRmMTFiOGVlYzIzMWEzYzMyYzE5OTBlZmZkMWU5MGU4Iiwic3ViIjoiODA1ODc4NDk4ODQiLCJleHAiOjE3NTQ4OTE4OTQsIm5iZiI6MTc1NDg5MTgzNCwiaWF0IjoxNzU0ODkxODM0LCJqdGkiOiJhYjgxZGQ2Mi02YjE1LTRmM2EtYmRkNy1hMWZiMGI5MTk1ODciLCJzaWQiOiI1MWNkMjliMy0xMDE5LTRiYzctOTYzMS02Mjg0OTdhZTllNjEiLCJzaWciOiI1ODUxNGFiNTI3OWUxMGI4MTFkNjUzYWY2YmI3ZGZkNWZlMDM5YTE3N2FhNTI2Nzg5NjIyOWVjM2Q1YTBiODNlIn0.6DOOFNbi_NyPEKbBMmzpWc5uw-DbF5U_fsr6Gp3CWzo': signature verification failed | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Attempting to authenticate session token | {shop: test-store-2222000.myshopify.com, sessionToken: {"search":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczpcL1wvdGVzdC1zdG9yZS0yMjIyMDAwLm15c2hvcGlmeS5jb21cL2FkbWluIiwiZGVzdCI6Imh0dHBzOlwvXC90ZXN0LXN0b3JlLTIyMjIwMDAubXlzaG9waWZ5LmNvbSIsImF1ZCI6ImRmMTFiOGVlYzIzMWEzYzMyYzE5OTBlZmZkMWU5MGU4Iiwic3ViIjoiODA1ODc4NDk4ODQiLCJleHAiOjE3NTQ4OTE4OTQsIm5iZiI6MTc1NDg5MTgzNCwiaWF0IjoxNzU0ODkxODM0LCJqdGkiOiJhYjgxZGQ2Mi02YjE1LTRmM2EtYmRkNy1hMWZiMGI5MTk1ODciLCJzaWQiOiI1MWNkMjliMy0xMDE5LTRiYzctOTYzMS02Mjg0OTdhZTllNjEiLCJzaWciOiI1ODUxNGFiNTI3OWUxMGI4MTFkNjUzYWY2YmI3ZGZkNWZlMDM5YTE3N2FhNTI2Nzg5NjIyOWVjM2Q1YTBiODNlIn0.6DOOFNbi_NyPEKbBMmzpWc5uw-DbF5U_fsr6Gp3CWzo"}}
-
August 11, 2025 at 11:27
[shopify-app/DEBUG] Validating session token | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
[shopify-app/INFO] Authenticating admin request | {shop: test-store-2222000.myshopify.com}
-
August 11, 2025 at 11:27
🔍 [AUTH] Request URL: http://ecommerce-frontend.1courier-test.com/app?embedded=1&hmac=052f798e2fbb88f8e1bcb0174179d3e414a88a0ebb08c443f7d58b5f8114aa39&host=YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvdGVzdC1zdG9yZS0yMjIyMDAw&id_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczpcL1wvdGVzdC1zdG9yZS0yMjIyMDAwLm15c2hvcGlmeS5jb21cL2FkbWluIiwiZGVzdCI6Imh0dHBzOlwvXC90ZXN0LXN0b3JlLTIyMjIwMDAubXlzaG9waWZ5LmNvbSIsImF1ZCI6ImRmMTFiOGVlYzIzMWEzYzMyYzE5OTBlZmZkMWU5MGU4Iiwic3ViIjoiODA1ODc4NDk4ODQiLCJleHAiOjE3NTQ4OTE4OTQsIm5iZiI6MTc1NDg5MTgzNCwiaWF0IjoxNzU0ODkxODM0LCJqdGkiOiJhYjgxZGQ2Mi02YjE1LTRmM2EtYmRkNy1hMWZiMGI5MTk1ODciLCJzaWQiOiI1MWNkMjliMy0xMDE5LTRiYzctOTYzMS02Mjg0OTdhZTllNjEiLCJzaWciOiI1ODUxNGFiNTI3OWUxMGI4MTFkNjUzYWY2YmI3ZGZkNWZlMDM5YTE3N2FhNTI2Nzg5NjIyOWVjM2Q1YTBiODNlIn0.6DOOFNbi_NyPEKbBMmzpWc5uw-DbF5U_fsr6Gp3CWzo&locale=en&session=24cd2c72acc4ae8d6207323385ce6ddef395d7d578a60aad403f1e3e1af5c923&shop=test-store-2222000.myshopify.com&timestamp=1754891834
-
August 11, 2025 at 11:27
🔍 [AUTH] Request method: GET

Reproduction steps

1. Create an embedded app using SvelteKit (via Shopify CLI).
2. Scaffold a new Remix app using Shopify CLI.
3. Rebuild the SvelteKit app’s functionality in the new Remix codebase.
4. Link the existing SvelteKit app configuration to the new Remix app.
5. Start the Remix app and load it in the embedded Shopify environment — session token validation fails.
6. As a comparison, create a new Shopify app from scratch.
7. Link this new app configuration to the same Remix app codebase.
8. Load it in the embedded Shopify environment — session token validation works as expected.

Operating System

Mac OS Sonoma

Shopify CLI version (shopify --version)

3.83.3

Shell

iTerm

Node version (run node -v if you're not sure)

v24.5.0

What language and version are you using in your application?

Node.js version: v24.5.0, npm version: 11.5.1, Remix version: ^2.16.1