Shopify access scopes and protected customer data

When you connect an app to your Shopify store, you approve a list of permissions. That list determines what the integration can read and write for the rest of its life, and it is more consequential than the click-through suggests.

For finance integrations in particular, two things go wrong regularly: asking for too little and having to start again, and asking for too much and failing a review.

What a scope actually is

A named permission for one area of the store, split between reading and writing. Read access to orders is distinct from write access to orders, and both are distinct from anything to do with products, customers, inventory, fulfilment or discounts.

The important consequence is that scopes are granted at installation. An integration that later discovers it needs an additional permission cannot simply take it. The merchant has to approve the expanded list, which in practice means a reinstall or a re-authorisation, and that is disruptive enough that vendors avoid it — sometimes by requesting more than they need at the outset.

Which creates the tension: request narrowly and risk a reinstall, or request broadly and give the merchant a permission list that looks alarming.

What a finance integration genuinely needs

For reconciliation and accounting, the list is fairly short and mostly read-only.

Orders, which is the core of it. Read access, and specifically including the historical window question covered below.

Products and variants, for identifying what was sold and for cost of goods where the merchant has entered it.

Inventory, if stock valuation or multi-location reporting is in scope.

Customers, which is where the approval question arises rather than the permission question.

Fulfilments and shipping, to connect an order to its delivery and its courier charge — see capturing the consignment note against the order.

Write access is a separate conversation. A pure accounting integration usually needs none, and an integration that also syncs stock or updates fulfilment status needs it narrowly. Read-only where possible is worth insisting on, because it bounds the worst case if the integration misbehaves.

Protected customer data is not just a scope

This is the part that differs from ordinary permissions and it catches vendors out.

Shopify treats customer personal information as a protected category requiring approval rather than merely a granted scope. An app wanting access has to state what it uses the data for, and satisfy Shopify that its handling, retention and security are appropriate. Fields considered more sensitive attract more scrutiny than the minimum needed to identify an order.

Two practical consequences.

Approval takes time and can be refused. It is not a checkbox, and it is a genuine step in any project plan involving customer detail.

A well-designed finance integration may not need it. Reconciliation is about amounts, references and dates. It rarely needs a customer's name, address or phone number, and an integration that avoids requesting protected data avoids an approval process, reduces its own risk surface, and gives the merchant less to worry about.

That last point is worth pressing a vendor on. If they are asking for customer personal data, ask what they do with it. Sometimes the answer is good — matching a receivable to a business customer, for instance. Sometimes it is habit.

What you should ask before installing

Five questions, and they are all reasonable.

Which scopes are you requesting, and why each one. A vendor should be able to justify every item. If they cannot, they are requesting broadly.

Is any of it write access. And if so, exactly what will it change in my store.

Do you request protected customer data. And if so, what is it used for, where is it stored, and for how long.

What happens if I want to reduce the permissions later. Usually the answer is a reinstall, and knowing that in advance is better than discovering it.

Where do the credentials live. An access token is a key to your store, and it should be held securely rather than sitting in a configuration file somebody can read.

This is the same interrogation you would apply to any system touching your finances — see how to evaluate AI accounting software.

The uninstall question

Rarely asked and it matters.

When an app is removed, its access ends immediately. What happens to the data it already holds is a separate matter governed by its own policy and by your agreement, not by Shopify.

So the question to settle before installing, not after, is what happens to your order history in the vendor's system if you leave. For an accounting integration the answer needs to be that you can export it, because it is the supporting detail behind your own books — the same principle as pulling gateway history before closing an account, and for the same reason — see switching payment gateway without losing your history.

Common questions

Can a Shopify app add permissions after installation?

Not by itself. Scopes are granted when the app is installed, so an integration that later needs an additional permission requires the merchant to approve the expanded list, which in practice means a reinstall or re-authorisation. Because that is disruptive, some vendors request more than they need at the outset, which is why asking them to justify each scope is worthwhile.

What is Shopify protected customer data?

Customer personal information, which Shopify treats as a category requiring approval rather than as an ordinary granted scope. An app must state its purpose and satisfy Shopify about its handling, retention and security, with more sensitive fields attracting more scrutiny. Approval takes time and can be refused, so it belongs in any project plan that involves customer detail.

Does an accounting integration need customer personal data?

Often not. Reconciliation depends on amounts, references and dates rather than on names, addresses or phone numbers, so an integration that avoids requesting protected data also avoids an approval process and reduces its own risk surface. Where it is requested, the use should be specific — matching a receivable to a business customer, for example — rather than habitual.

What happens to your data when a Shopify app is uninstalled?

Its access to your store ends immediately, but what it does with the data it already holds is governed by its own policy and your agreement rather than by Shopify. For an accounting integration that history is the supporting detail behind your books, so the ability to export it should be settled before installing rather than after deciding to leave.

Related: what the Shopify Admin API actually returns · the Shopify sixty-day order window · Shopify app types and which one you need