App Store readiness & reliability
- Fixed
Embedded security hardening: all in-app API routes require a valid Shopify session token (Authorization: Bearer …) and derive shop identity from the token to prevent tenant spoofing.
- Improved
Google Ads sync: daily campaign + performance sync with automatic access token refresh (offline refresh_token) and MCC support (login-customer-id).
- Improved
Meta Ads sync: proactive long-lived token renewal to reduce disconnects and improve day-to-day reliability.
- Improved
Smart uninstall handling: if Shopify returns 401 (token revoked), the shop is marked uninstalled to stop background jobs from calling a dead store.