Shopify App Permissions Explained: What Each Access Request Lets an App Do
Shopify app permissions are the parts of your store an app is allowed to see or change. They fall into three groups by risk. Reading your products, pages or shipping settings is low risk. Seeing orders and customer details is medium risk, because it involves personal data. Changing your theme, adding scripts to your store pages, or editing orders and customers is high risk, because a compromised app with that access can change what every shopper sees.
Most merchants accept these permissions in a second and never look again. After the October 2026 attacks, where compromised apps were used to send shoppers to fake checkout pages, it is worth knowing what you agreed to. Here is what happened in those attacks.
Where you see an app’s permissions
- Before you install. The install screen lists what the app wants to view and edit. This is the best moment to say no.
- After you install. In your Shopify admin, go to Settings, then Apps, and open the app. Its details show the access it holds.
- When an app updates. If an app wants more access later, Shopify asks you to approve it. Read that request as carefully as the first one.
Shopify words these in plain language on screen, such as “View and edit products”. Behind each one is a technical name like read_products or write_products. “Read” means the app can see it. “Write” means it can change it.
Low-risk access: reading your store’s public information
This covers things most of the world can already see on your storefront, or that don’t involve anyone’s personal data.
| What the app can do | Technical name | Typical apps that need it |
|---|---|---|
| See your products, prices and stock | read_products, read_inventory | Search, recommendations, size charts, chat apps |
| See your pages, blog posts and navigation | read_content | SEO tools, chat apps, translation apps |
| See your shipping settings | read_shipping | Delivery estimate apps, chat apps |
| See your discounts | read_discounts | Upsell apps, chat apps |
| See your theme | read_themes | Apps that check where to place themselves on your store |
Medium-risk access: orders and customer details
This is where personal data comes in: names, emails, phone numbers and addresses. Shopify treats this as protected customer data, and developers must request it and meet Shopify’s data protection rules before they can use it.
| What the app can do | Technical name | Typical apps that need it |
|---|---|---|
| See your orders | read_orders | Order tracking, reviews, accounting, chat apps that answer “where’s my order?” |
| See all orders, not just the last 60 days | read_all_orders | Reporting and accounting tools |
| See your customers | read_customers | Email marketing, loyalty, CRM apps |
The question to ask: does the app need to see this to do its job? An order tracking app does. A countdown timer doesn’t.
High-risk access: changing what shoppers see and do
This is the access that matters most for security. If an app with this access is compromised, the attacker can use it against your customers, not just your data.
| What the app can do | Technical name | Why it’s high risk |
|---|---|---|
| Edit your theme | write_themes | Can change the code of any page on your store, including links and buttons that lead to checkout |
| Add scripts to your store pages | write_script_tags | Can load code from the app’s own servers on your pages. If those servers are compromised, so is your store |
| Change checkout and payment options | Checkout and payment customization permissions | Can change what shoppers see at the moment they pay |
| Edit orders | write_orders | Can change order details, tags and notes |
| Edit customers | write_customers | Can change customer records, contact details and marketing consent |
| Edit products | write_products | Can change product details, prices and descriptions |
Some apps genuinely need this. A page builder has to edit your theme. A product feed app may need to edit products. The point is not to refuse every high-risk request. It is to grant it only to apps you trust, actively use, and would notice misbehaving.
A note on theme app embeds
Many apps now add themselves to your store through app embeds and app blocks, which you manage in the theme editor (Online Store, Themes, Customize). This is Shopify’s recommended method. It is easier to see and control than older methods: every app embed has an on and off switch, and turning one off removes it from your store straight away, without touching code.
App embeds still run the app’s code on your store, so they are not risk-free. In the October attacks, Hulk Product Options’ app embed was unchanged, but it loaded settings from the developer’s servers, and the attackers put their code into those settings. That is why permissions are only half the picture: what an app does with its access also depends on the security of the developer’s own systems. But if you ever need to shut an app off quickly, the app embeds panel is the first place to go.
How to tidy up your permissions in 15 minutes
- Open Settings, then Apps, and list every installed app.
- Remove any app nobody on your team actively uses.
- For each app that remains, open it and read its access. Flag any with high-risk access.
- For each flagged app, ask: do we still need it, and do we trust the developer to respond fast in an incident?
- Open your theme editor, go to App embeds, and switch off any embed that belongs to an app you removed or don’t recognise.
For a full check after the October attacks, see how to check if your store was affected. Before your next install, use our seven checks for vetting a Shopify app.
What a customer service chat app should need
As a worked example, here is what a customer service chat app needs to do its job well. To recommend products, it reads your products, stock and discounts. To answer delivery questions, it reads your shipping settings. To answer “where’s my order?”, it reads your orders. To know your policies, it reads your store pages.
AeroChat is a chat app on the Shopify App Store. Its install screen lists exactly what it asks for, so you can run it through this same test before you agree to anything. If it passes, start for free on the Shopify App Store.
Frequently asked questions
Can I change an app’s permissions after installing it?
Not one by one. The app holds the access you approved at install, plus any extra you approved later. If you’re not comfortable with an app’s access, the way to remove it is to uninstall the app.
Does uninstalling an app remove its access?
Yes. Uninstalling ends the app’s access to your store. Some apps leave code in your theme that keeps loading after uninstall, so check your theme and app embeds afterwards.
What does “read all orders” mean?
By default, apps can only see your orders from the last 60 days. “Read all orders” lets an app see your full order history. Shopify only grants it to apps that explain why they need it, such as accounting and reporting tools.
Can an app see my customers’ card details?
No. Card numbers are handled by Shopify’s payment systems, and apps don’t get access to them through these permissions. That is why the October attacks used fake checkout pages, built to get shoppers to type their details somewhere else.
