---
title: Shopify App Permissions Explained Before You Install
description: A guide for Shopify merchants on how to read and evaluate app permissions. Understand the difference between read and write access to keep your store data safe.
canonical: https://actorly.app/blog/how-to-read-shopify-app-permissions-before-you-install
---

[← Blog](https://actorly.app/blog) [Shopify apps](https://actorly.app/blog/category/shopify-apps)

# How to read Shopify app permissions before you install

Learn to read the app installation screen to understand what data an app can view or change in your store, and decide if the access it asks for is right

[Odera Joseph Echendu](https://actorly.app/authors/odera-joseph-echendu) Oct 16, 2026 8 min read

When you install a Shopify app, the consent screen shows you the specific store data the app needs to access. Reviewing this information carefully helps you understand what an app can see and change, allowing you to decide if its requested permissions are appropriate for its function before you grant it access. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/install-setup-apps))

## Key takeaways

- An app's permissions are divided into "read" (viewing data) and "write" (modifying data). A write permission also includes the ability to read.
- Permissions an app has are separate from the permissions your staff have. Limiting a staff member's access to an app does not reduce what the app itself can do.
- Before installing, check that the permissions an app requests match its stated purpose. An analytics app, for example, should not typically need to change your products.
- For apps already installed, you can review their permissions and recent activity from your Shopify admin, including any permissions the app hasn't used recently. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps))

## What am I looking at on the app install screen?

The screen that appears before you finalize an app installation is a summary of the access the app requires to function. Shopify organizes these permissions into two main categories: View personal data and View and edit store data. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/install-setup-apps))

You can expand each of these categories to see a detailed list of the specific types of information the app wants to access. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/install-setup-apps)) For example, under View and edit store data, you might see permissions for products, orders, or discounts.

This screen also includes a link to the app developer's privacy policy. It is good practice to review this document to understand how the developer handles your store's and your customers' data. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/install-setup-apps)) To proceed, you must click the Install button to authorize the app's access.

## What is the difference between read and write access?

Understanding the distinction between "read" and "write" access is the most important part of evaluating an app's permissions. Each permission, known as an "access scope" by developers, governs what an app is allowed to do. ([Manage access scopes](https://shopify.dev/docs/apps/build/authentication-authorization/manage-access-scopes))

- **Read access** allows an app to view data. For example, the read_products scope lets an app see your product information. This is common for analytics, reporting, or merchandising apps that display your catalog in a new way.
- **Write access** allows an app to modify data. The write_products scope lets an app create new products or change existing ones. This is necessary for apps that sync inventory, update prices in bulk, or push products to other sales channels.

A write permission always includes the corresponding read permission. ([Manage access scopes](https://shopify.dev/docs/apps/build/authentication-authorization/manage-access-scopes)) An app that asks for write_products does not need to ask for read_products separately.

This difference is critical for risk assessment. An app with only read access presents a data privacy consideration, as it can see potentially sensitive customer or order information. According to [Neat](https://neat.digital/blogs/blogs/shopify-app-permissions-audit-reduce-access-guide-2026), an app with write access presents an operational consideration, as it can actively change your storefront, inventory levels, pricing, and other core business data.

## How do I decide if an app's permissions are reasonable?

An app's function should justify the access it requests. An app for running reports on sales trends needs to read order data, but it likely has no reason to modify your theme. Use the following table as a guide to think through whether an app's requested permissions align with its job.

App CategoryCommon JobReasonable Read Access (Examples)Reasonable Write Access (Examples)What to Question

**Storefront Design & Merchandising** Page builders, product reviews, upsell pop-ups.read_products, read_content write_content, write_products, write_themes write_orders or write_customers. Why does a page builder need to modify customer records or orders?

**Orders, Payments & Customer Service** Returns, subscriptions, fraud, and order management.read_orders, read_customers, read_fulfillments write_orders, write_customers, write_fulfillments write_themes. Why does an order management tool need to change your theme code?

**Inventory, Fulfilment & Channels** Inventory sync, warehouse management, and sales channel feeds.read_inventory, read_products, read_locations write_inventory, write_products read_customers. Why does an inventory sync tool need to see your customer data?

**Marketing, Analytics & Privacy** Email marketing, advertising attribution, and analytics dashboards.read_customers, read_orders, read_marketing_events write_marketing_events, write_pixels write_products. Why does an analytics app need to modify your products?

Source: [Shopify App Permissions Audit: A Merchant Guide - Neat Digital](https://neat.digital/blogs/blogs/shopify-app-permissions-audit-reduce-access-guide-2026)

Example: A merchant wants to install an app that promises to create visual dashboards of their sales performance. On the installation screen, the app requests permission to read_orders and read_products. This is reasonable, as the app needs to see order and product data to build its reports. However, the app also requests write_themes. This permission would allow the app to modify the online store's theme code. Since a reporting tool should not need to change the store's design, this is a permission to question. Before clicking install, the merchant should investigate why this access is needed, check the app's reviews for any mention of this, or look for an alternative analytics app with more limited permissions. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/install-setup-apps))

## How do I check permissions for apps I already have installed?

You can review the permissions and activity for any third-party app you have already installed directly from your Shopify admin. This is a helpful way to audit what your apps are doing. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps))

1. From your Shopify admin, go to **Settings** > **Apps**. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps))
2. Click the name of the app you want to review. This opens the app's about page.
3. If an app has permissions that it has not used in the last 30 days, Shopify will display these in a subsection called **Unused access**.

This view gives you a clear picture of what an app is permitted to do versus what it has done recently. Note that, according to Shopify, this activity tracking is available for third-party apps but not for apps made by Shopify ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps)).

## Common mistakes when evaluating app permissions

Avoiding a few common misunderstandings can help you make better decisions about the apps you use.

**Confusing staff permissions with app permissions** Restricting a staff member from using certain apps does not change the permissions of the app itself. According to [Neat](https://neat.digital/blogs/blogs/shopify-app-permissions-audit-reduce-access-guide-2026), if an app has permission to write products, it can do so through its API connection to your store, regardless of which staff member is logged in. These are two separate layers of security that should both be managed.

**Ignoring the risks of read-only access** An app that can't change your data can still pose a risk. Access to customer, order, and fulfillment data is sensitive. When granting read-only access, it is still important to trust the app developer and understand their privacy policy. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps))

**Treating "unused access" as an automatic red flag** When Shopify reports that an app has "Unused access," it's a signal to ask a question, not a definitive judgment. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps)) Some apps may have permissions for features that are only used in specific situations, such as a seasonal promotion, a data export, or a disaster recovery function. It is a good reason to contact the developer and ask if the permission is still required for your use case.

**Forgetting about an app's other components** An app can influence your store even if you rarely open its dashboard. Many apps use extensions, Functions, and pixels to add features to your checkout, customer accounts, or online store theme. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps)) You can see a summary of these components on the app's about page, which helps you understand its full impact on your store's operation and customer experience.

## Frequently asked questions

### Can I change an app's permissions after I install it?

You cannot directly change an app's permissions yourself through a settings panel. However, if a developer updates their app to require new permissions, Shopify will prompt you to approve the new access the next time you open the app. You can always review an app's currently granted permissions on its about page in your admin. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps))

### Why does a simple reporting app need to access my orders?

To create reports about your sales, an app needs to be able to read your order data. ([Manage access scopes](https://shopify.dev/docs/apps/build/authentication-authorization/manage-access-scopes)) The key permission to look for is read_orders. If a reporting app also requests write_orders, that would be a reason to question why it needs the ability to modify your order history.

### What should I do if an app has "unused access"?

If you see that an app has permissions it hasn't used in over 30 days, consider its function. ([Shopify Help Center](https://help.shopify.com/en/manual/apps/managing-apps)) If it's for a seasonal tool or a backup utility, the lack of activity might be normal. If not, it's reasonable to contact the app developer and ask if that permission can be removed for your store.

### What does it mean when an app requests access to "protected customer data"?

Shopify classifies certain customer data as protected. For an app to see these specific fields, it must not only have the correct permission (like read_customers) but must also be reviewed and approved by Shopify for that access. ([Manage access scopes](https://shopify.dev/docs/apps/build/authentication-authorization/manage-access-scopes)) Until it is approved, Shopify will hide that specific data from the app.

## Read next

- [Can you undo a change in Shopify?](https://actorly.app/blog/can-you-undo-a-change-in-shopify)

Written by [Odera Joseph Echendu](https://actorly.app/authors/odera-joseph-echendu) Founder of Actorly

Odera Joseph Echendu is the founder of Actorly, a Shopify app from ONDUTYOPS LLC that keeps a searchable history of the changes it can see in a store. He spent seven years leading customer support and technical support inside high-growth SaaS and e-commerce companies.

[All posts by Odera Joseph Echendu](https://actorly.app/authors/odera-joseph-echendu)

## Keep reading

[Security and fraud Where to find who removed a staff member in Shopify:](https://actorly.app/blog/where-to-find-who-removed-a-staff-member-in-shopify)[Privacy and compliance How to add a privacy policy to your Shopify store:](https://actorly.app/blog/how-to-add-a-privacy-policy-to-your-shopify-store)[Pricing, discounts and sales Why did my Shopify discount stop working?:](https://actorly.app/blog/why-did-my-shopify-discount-stop-working)