Most Shopify apps ask for more permissions than they need. Not always maliciously. Often a developer ticked every box during initial development, never went back to scope them down, and shipped a permission list that reads like the app accesses your entire commerce stack. The merchant sees the consent screen, shrugs, clicks install, and a small app with a single visible feature now has read and write on orders, customers, fulfillments, inventory, and a dozen other resources it will never use.

This guide is the four-step audit we use on every app we evaluate (including our own). It takes under ten minutes per app. It will not catch every problem, but it catches the obvious ones, and the obvious ones are 80 percent of the risk.

Step 1: read the permission list before installing

Sounds obvious. Almost nobody does it. The Shopify App Store listing page has a "Data access" section that lists every scope the app requests. Read it. The app should list every scope with a one-line explanation. If the explanation is missing or reads like marketing copy ("to provide the best experience"), that is a signal the developer cannot articulate why the scope is needed.

A well-scoped app reads like a table: scope, why, single feature it powers. A poorly scoped app reads like a paragraph of evasion.

Step 2: map each permission to a feature

For every permission the app requests, identify the visible feature in the app that requires it. If you cannot map a permission to a feature, the app does not need that permission, regardless of what the developer says.

Common scopes and what they actually justify. read_products + write_products: the app modifies product data (titles, descriptions, images, prices, variants). If the app's only visible feature is, say, sending shipping notifications, it has no business asking for write access on products. read_orders + write_orders: the app reads order details (line items, shipping address, fulfillment status). Justified for fulfillment apps, shipping calculators, accounting integrations. Not justified for image apps, theme tools, or analytics dashboards. read_customers + write_customers: the app reads or modifies customer data. Justified for email marketing, loyalty programs, customer-segmentation apps. Not justified for anything not customer-facing.

Run this mapping in your head before clicking install. If two thirds of the requested scopes have no obvious feature behind them, the app is over-scoped.

The shortest test for app integrity: open the Shopify App Store listing and try to write a one-sentence justification for every scope the app asks for. If you cannot do it after reading the description, the developer cannot either.

Step 3: check what the app does NOT touch

Often more informative than the list of requested scopes is the list of scopes the app explicitly does NOT request. A well-built app will say so in its privacy policy or listing: "Viking Watermark does not access orders, customers, fulfillments, or payment data." A poorly built app makes no such statement, and you have to infer scope by what was checked.

The honest signal: an app that publicly lists what it does NOT access is signaling that the scoping was deliberate. An app that does not list this either has not thought about it or does not want you to think about it. Both are bad signs in 2026.

Step 4: verify the listing matches the install screen

This catches the most common quiet manipulation. The App Store listing page shows the "Data access" section, but the actual Shopify consent screen at install time shows a different (sometimes broader) scope set. Apps occasionally get away with this because nobody compares.

The check: open the App Store listing in one tab, click install, and on the consent screen, verify every scope listed also appears on the listing page. If the install screen shows scopes that were not disclosed on the listing page, do not click consent. Email the developer and ask why the lists differ. A legitimate developer will explain (sometimes Shopify updated the scope graph and the listing is stale). A sketchy developer will go silent.

Three red flags that should kill the install

Beyond the four-step audit, three patterns we have seen in apps we ended up uninstalling within a week.

  • 01"Customer data export" capability for an app that has no customer-facing feature. A merchandising app that can export your customer database is one breach away from being a customer-data leak.
  • 02Privacy policy hosted on a free Google Doc. Real apps have a real privacy policy on their own domain. A free Doc means the developer treated compliance as an afterthought.
  • 03Vague subprocessor list ("we use industry-standard services"). Real apps list their subprocessors by name (e.g., "We use Stripe for billing, Sendgrid for email, Cloudflare for CDN"). Vague language means either the developer does not know what their stack does or does not want you to know.

What to do if you already installed something sketchy

Two quick fixes. First, audit your installed apps right now in Shopify admin under Apps. For each one, click into the data-access summary and run the four-step audit. Apps that fail, uninstall. Shopify revokes their access tokens immediately, but they may keep cached data, so also email the developer asking for confirmation of data deletion (most have an obligation to comply within 30 days under GDPR).

Second, set a rule going forward: do not install an app without running the four-step audit, no matter how good the App Store reviews look. Reviews tell you the app works, not that the developer was thoughtful about your data.

For an example of what an honest permission list looks like in practice, our own Viking Watermark permissions page maps every scope to the feature that needs it. That is what you should expect from any app you install.

Frequently asked questions

How can I see all the permissions a Shopify app currently has on my store?

Shopify admin, then Apps, then click the app. The data-access summary appears at the bottom of the app's page. For deeper detail, the consent screen at install time shows the canonical scope list.

What is the most over-requested Shopify app permission?

In our audits, the customers scope, especially when the app has no customer-facing feature. After that, the orders scope when the app is not order-related (theme tools, analytics dashboards, image tools).

Can I install a Shopify app and selectively deny some permissions?

No. Shopify uses an all-or-nothing consent model. You either accept the full scope list or you do not install. The only way to limit risk is to pick apps that ask for less.

What is the difference between Shopify app permissions and webhooks?

Permissions are read and write access to your store's resources. Webhooks are event subscriptions that fire when something changes. An app can have permissions without using webhooks, or webhooks for a resource it has not requested permission on (in which case the webhook fires but the app cannot do anything with it).

Does Shopify review apps for permission abuse?

Shopify reviews apps before they get listed on the App Store, and they have an automated scope-justification check. The review catches obvious over-scoping. Subtle over-scoping passes through and is on the merchant to catch.

What should I do if a Shopify app is asking for orders access but does not need it?

Email the developer and ask why. A legitimate developer will explain (sometimes for analytics, sometimes for legacy reasons). If the answer is vague or the developer goes silent, do not install. There is almost always an alternative app with tighter scope.

How long does Shopify keep an uninstalled app's cached data?

Shopify revokes the app's access tokens immediately on uninstall. The app may have its own copy of data that was previously transferred. Under GDPR and Shopify Partner policy, the developer must delete that data within 30 days. Email them to confirm if it matters to your compliance posture.