Shopify custom app permissions

Shopify custom app permissions: what was approved at install, and why a change asks again

Direct answer. A custom app or other installed app can use an access scope only after that scope is approved on the store. Shopify’s developer docs say required scopes are granted when the merchant installs the app, and that if you add scopes, merchants are prompted to approve them. Review what an installed app can access in Shopify admin under Settings > Apps. Read Manage access scopes and Managing apps. This page is not legal advice.

Staff Access Audit Guard (Shopify App Store · Write a review) reviews installed-app access and staff access records. It does not change an app’s scopes. This page is how custom-app permissions are approved and reviewed — not the catalogue of what each scope name allows.

Related: Agentic Catalog by momiji — Crawler rules and complete product JSON-LD for shopping agents.

Free check first: App access scope reader runs in your browser and sends nothing. Paste an app’s access scopes and see which touch customer data or can write.

Approved at install

Shopify API access scopes say Shopify grants access scopes to public or custom apps, and that declaring a scope is not the same as having it. A scope takes effect only after it is approved on the store. On the manage access scopes page, required scopes (the scopes configuration) are ones merchants must grant when they install the app, so the app has them after installation. Optional scopes are requested after installation; merchants can grant them, decline them, or revoke ones they granted.

The Shopify Help Center page Installing and setting up apps says that when you create a custom app you define what data and features it can access through API scopes, and that each version can have different configurations and scopes. About custom apps says you create and manage custom apps in the Dev Dashboard. It also says that, starting 1 January 2026, new custom apps are not created as legacy custom apps in the admin; legacy custom apps created before that date can still be managed from the admin. Store owners can create and manage custom apps. To let a staff member create, edit, or delete them, assign App development > Develop. Collaborators cannot access the Dev Dashboard, because they do not have organization-level permissions.

How to review an app’s access in admin

Managing apps says Settings > Apps lists installed apps. Click the app name to open its about page. That page includes permission details. The Activity and permissions section shows which areas of the store the app can view or edit, and the date of the most recent activity in each area. Permissions unused in the last 30 days appear under Unused access. The Privacy section groups personal data the app can access. Shopify notes that activity and permissions are currently tracked only for third-party apps on that screen, and that apps made by Shopify are not tracked the same way. For a custom app’s configuration, the same page says Settings > Apps > Develop apps > Build apps in Dev Dashboard.

What a scope name such as read_orders covers is the separate page Shopify app access scopes explained.

Why a changed scope asks for approval again

shopify.dev says you can change declared scopes after the app is installed, but the app can use a scope only once it is approved on the store. If you change the required scopes list:

• Merchants are prompted to approve the updated scopes when they open the app. The app/scopes_update webhook fires when they approve.
• If the change only removes scopes, the merchant is not prompted. The app loses those scopes when the merchant opens the app.

If you add optional scopes, the install’s granted scopes do not change until the app requests them and the merchant grants them. The same page says that if the app acts only on stores in your own organization, you approve the change yourself when you release the version, so there is no separate merchant consent step. Read both sentences on the live page and follow the path that matches how the app was created. In every other case, the page says merchants are prompted to approve scopes you add.

Staff permissions to manage apps

Store permissions on the Help Center separate staff rights from the app’s own API scopes. Help Center says app permissions in the Shopify admin do not change or impact permissions set up through apps.

• Manage and install apps and channels. The user can add, access, or delete apps and channels if their permissions match the permissions the app or channel requires.
• Develop (under App development). The user can create and update custom apps installed on the store.
• Enable development. Lets users and collaborators develop custom apps. Shopify says this also requires Manage and install apps and channels, so the user can open Apps and sales channels settings.

If a role is limited to specific apps, Shopify says that user can open only those apps and cannot install or delete apps. shopify.dev’s scope troubleshooting says a call can still fail for one staff member and succeed for another when the app has the scope but the staff member does not have the matching store permission. The merchant adjusts staff permissions in the admin. That narrowing is not the same thing as editing the app’s access scopes.

Checklist

• Settings > Apps, open the app, and read permission details, Activity and permissions, and Privacy. Remember Shopify’s note that activity tracking on that screen is currently for third-party apps.
• For a custom app’s scopes, open the app version in the Dev Dashboard. Help Center says each version can have different scopes.
• Treat required scopes as granted at install, and optional scopes as granted only when the merchant approves the later request.
• If scopes were added, expect an approval prompt when the app is opened, unless the own-organization path on shopify.dev applies. Removing scopes does not prompt; access drops when the app is opened.
• Give staff Develop only if they should create or update custom apps, and Manage and install apps and channels only if they should install or remove apps. Those staff permissions do not rewrite the app’s API scopes.

What this page is not

• Not legal advice, and not a list of every scope name. That list is app access scopes explained.
• Not a way to change scopes from this website. Approval happens in Shopify admin or the Dev Dashboard.
• Not a statement that every custom app shows the same activity table. Shopify limits that tracking note to third-party apps.

Related pages

• App access scope reader
• Shopify app access scopes explained
• Shopify collaborator permissions — collaborator roles, not install scopes
• Audit Shopify app scopes for customer data access — granted scopes, not the customer records
• Shopify Help Center: managing apps
• Shopify Help Center: store permissions
• shopify.dev: manage access scopes
• shopify.dev: API access scopes
• Staff Access Audit Guard — live App Store listing
• Shopify apps hub
• Tools

Not legal advice. Confirm the live Help Center pages and the shopify.dev access-scope docs before you treat a scope as granted or a staff permission as permission to change an app. The app reviews access records; it does not grant scopes.