# Shopify app permissions explained: what each access request lets an app do

Source: https://merchantstackdaily.com/blog/2026-11-08-shopify-app-permissions-explained.html

Published October 6, 2026


Shopify app permissions are access scopes that control what an app can read or change: read scopes let an app see data, write scopes let it change data. Low-risk scopes cover public store information, medium-risk scopes cover orders and customer details, and high-risk scopes cover editing the theme and adding scripts to store pages. By default an app can only see orders from the last 60 days; read\_all\_orders extends that to the full history.

## Read means see, write means change

Shopify app permissions are access scopes, permission strings that define exactly which store data an app is allowed to read or modify, and Shopify enforces them at the API layer. Shopify words them in plain language on screen, such as View and edit products, and behind each one is a technical name like read\_products or write\_products. Read means the app can see it. Write means it can change it, and any scope that writes a resource also grants read access to it, so the write scope should only be requested when the app needs both.

Apps declare their required scopes in their configuration and OAuth requests, and during installation the merchant sees the list and must approve it before the app receives an access token. Modern apps also use optional scopes, which let them request additional permissions only when a specific feature is enabled, instead of asking for everything at install. Shopify restricts access to scopes for apps that do not have a legitimate use for the data, and some scopes need Shopify approval before an app can even declare them, including the scopes for protected customer data.

## The three risk groups

The scopes fall into three groups by risk, and the grouping is the useful way to read them. Low-risk access covers public store information: read\_products for products, prices, and stock, read\_content for pages and blog posts, read\_shipping for shipping settings, read\_discounts for discounts, and read\_themes for the theme. Most of this is information the world can already see on the storefront, or data that involves no personal information.

Medium-risk access covers orders and customer details, which is where personal data enters: names, emails, phone numbers, and addresses. Read\_orders lets an app see orders, read\_customers lets it see customers, and read\_all\_orders extends the default 60-day order window to the full history. Shopify treats this as protected customer data, and developers must request it and meet Shopify's data protection rules before they can use it. High-risk access covers changing what shoppers see and do: write\_themes lets an app edit the code of any page, including links and buttons that lead to checkout, and write\_script\_tags lets it load code from its own servers onto store pages. A compromised app with that access can change what every shopper sees, which is exactly what happened in the October 2026 attacks, where compromised apps were used to send shoppers to fake checkout pages.

## The audit every merchant should run

The audit is short and worth doing once a quarter. Open the installed apps list and check each app's permissions against what the app actually does: a review app needs read\_orders, but it does not need write\_themes, and a chat app needs read\_content, but it does not need read\_all\_orders. Any scope that does not match the app's job is a reason to ask the developer why, or to remove the app.

Remove the apps you do not use, because an installed app keeps its scopes even when it is idle, and uninstalled apps often leave leftover code in the theme that should be cleaned up. Check specifically for write\_themes and write\_script\_tags, the two scopes that let an app change the store itself, and treat any app holding them as high-trust: it should be a vendor you know, with a real support channel and a recent update history. Scopes reduce the blast radius if an app is compromised, but only if the merchant keeps the list short and the permissions matched to the job.

## Related reading

If this topic is useful, these earlier guides go deeper on connected questions: [Shopify Search and Discovery Explained: The Free App That Runs Your Search Box](https://merchantstackdaily.com/blog/2026-10-24-shopify-search-and-discovery-explained.md), [Shopify Collabs Explained: The Creator Program Inside Your Admin](https://merchantstackdaily.com/blog/2026-10-24-shopify-collabs-explained.md), and [Shopify Functions Explained: The App Technology Replacing Scripts](https://merchantstackdaily.com/blog/2026-10-23-shopify-functions-explained.md).

## Frequently asked questions

### What is the difference between read and write scopes?

Read means the app can see the data, and write means it can change it. Any scope that writes a resource also grants read access to it, so the write scope should only be requested when the app needs both. Shopify enforces scopes at the API layer.

### What are the riskiest Shopify app permissions?

Write\_themes, which lets an app edit the code of any page including checkout links, and write\_script\_tags, which lets it load code from its own servers onto store pages. A compromised app with either scope can change what every shopper sees.

### Can a Shopify app see all my orders?

By default, apps can only see orders from the last 60 days. Read\_all\_orders extends that to the full order history, and it must be declared alongside read\_orders or write\_orders. Orders and customer details are protected customer data under Shopify's rules.

### How often should I audit my installed apps?

Once a quarter. Check each app's permissions against what it actually does, remove apps you do not use, and look specifically for write\_themes and write\_script\_tags. An installed app keeps its scopes even when it is idle.