Scopes
Apps request a set of scopes at install time. Each scope grants access to a group of/api/v1/* endpoints. The platform enforces scopes server-side on
every API call against the installation’s granted scopes — a request for
an endpoint outside the app’s granted scopes returns 403.
Scopes are passed as a comma-separated list on
/apps/oauth/authorize and returned
space-delimited in the scope field of the
token response. There are 37 scopes.
Reads and writes are separate.
write_* does not imply read_* —
request both if you need to read and write the same resource.Available scopes
read_analytics is read-only — there is no write_analytics scope.Scopes for common tasks
read_shop
Webhook subscription endpoints
(
POST /api/v1/webhooks.json) are
gated by read_shop — there is no dedicated webhook scope.(no scope)
Embedded admin access via
session tokens is authenticated by the
HS256 session-token JWT, not an OAuth scope. No scope is required to
request a session token.
read_files / write_files
The asset library is governed by
read_files / write_files. The App
Bridge resource picker File type runs in the
admin host context.Validation
Requested scopes are validated against the app’s registered scope set at authorize time. An unknown or unregistered scope returns:See also
- Authorize — start the OAuth flow with a scope list.
- Token — exchange the code; the response echoes granted scopes.
- Authentication — full OAuth walkthrough.