Published October 6, 2026

Shopify app permissions explained: what each access request lets an app do

Shopify app permissions are access scopes that control what an app can read or change: read scopes let an app see data, write scopes let it change data. Low-risk scopes cover public store information, medium-risk scopes cover orders and customer details, and high-risk scopes cover editing the theme and adding scripts to store pages. By default an app can only see orders from the last 60 days; read_all_orders extends that to the full history.

Read means see, write means change

Shopify app permissions are access scopes, permission strings that define exactly which store data an app is allowed to read or modify, and Shopify enforces them at the API layer. Shopify words them in plain language on screen, such as View and edit products, and behind each one is a technical name like read_products or write_products. Read means the app can see it. Write means it can change it, and any scope that writes a resource also grants read access to it, so the write scope should only be requested when the app needs both.

Apps declare their required scopes in their configuration and OAuth requests, and during installation the merchant sees the list and must approve it before the app receives an access token. Modern apps also use optional scopes, which let them request additional permissions only when a specific feature is enabled, instead of asking for everything at install. Shopify restricts access to scopes for apps that do not have a legitimate use for the data, and some scopes need Shopify approval before an app can even declare them, including the scopes for protected customer data.

The three risk groups

The scopes fall into three groups by risk, and the grouping is the useful way to read them. Low-risk access covers public store information: read_products for products, prices, and stock, read_content for pages and blog posts, read_shipping for shipping settings, read_discounts for discounts, and read_themes for the theme. Most of this is information the world can already see on the storefront, or data that involves no personal information.

Medium-risk access covers orders and customer details, which is where personal data enters: names, emails, phone numbers, and addresses. Read_orders lets an app see orders, read_customers lets it see customers, and read_all_orders extends the default 60-day order window to the full history. Shopify treats this as protected customer data, and developers must request it and meet Shopify's data protection rules before they can use it. High-risk access covers changing what shoppers see and do: write_themes lets an app edit the code of any page, including links and buttons that lead to checkout, and write_script_tags lets it load code from its own servers onto store pages. A compromised app with that access can change what every shopper sees, which is exactly what happened in the October 2026 attacks, where compromised apps were used to send shoppers to fake checkout pages.

The audit every merchant should run

The audit is short and worth doing once a quarter. Open the installed apps list and check each app's permissions against what the app actually does: a review app needs read_orders, but it does not need write_themes, and a chat app needs read_content, but it does not need read_all_orders. Any scope that does not match the app's job is a reason to ask the developer why, or to remove the app.

Remove the apps you do not use, because an installed app keeps its scopes even when it is idle, and uninstalled apps often leave leftover code in the theme that should be cleaned up. Check specifically for write_themes and write_script_tags, the two scopes that let an app change the store itself, and treat any app holding them as high-trust: it should be a vendor you know, with a real support channel and a recent update history. Scopes reduce the blast radius if an app is compromised, but only if the merchant keeps the list short and the permissions matched to the job.

Frequently asked questions

What is the difference between read and write scopes?

Read means the app can see the data, and write means it can change it. Any scope that writes a resource also grants read access to it, so the write scope should only be requested when the app needs both. Shopify enforces scopes at the API layer.

What are the riskiest Shopify app permissions?

Write_themes, which lets an app edit the code of any page including checkout links, and write_script_tags, which lets it load code from its own servers onto store pages. A compromised app with either scope can change what every shopper sees.

Can a Shopify app see all my orders?

By default, apps can only see orders from the last 60 days. Read_all_orders extends that to the full order history, and it must be declared alongside read_orders or write_orders. Orders and customer details are protected customer data under Shopify's rules.

How often should I audit my installed apps?

Once a quarter. Check each app's permissions against what it actually does, remove apps you do not use, and look specifically for write_themes and write_script_tags. An installed app keeps its scopes even when it is idle.