Access denied for orders field - read_orders scope not applied despite approval

Shopify App Store
1

Hello Shopify community,

I’ve been stuck on this issue for over a week and would really appreciate help.

The error:
“Error: Access denied for orders field”

My setup:

  • Shopify App template (React Router + Prisma)
  • Development store
  • Using Shopify CLI with Cloudflare tunnel
  • Node.js on Windows

What I’ve already done:

  1. Added read_orders to shopify.app.toml:
    scopes = “read_products,read_orders,read_customers”

  2. Requested Protected Customer Data access in Partners Dashboard
    (Store management + App functionality selected)

  3. Ran shopify app deploy multiple times

  4. Uninstalled and reinstalled the app several times

  5. Deleted sessions from the local database

  6. Updated .env with SHOPIFY_APP_URL matching the current
    Cloudflare URL

  7. Verified SHOPIFY_API_KEY and SHOPIFY_API_SECRET are correct

The problem:
When I install the app on my development store, the permissions
screen only shows:

  • Store owner data
  • Edit products
  • Edit online store

It does NOT show read_orders in the permissions list, even though
it’s declared in my scopes.

After installation, when the app tries to query orders, it fails
with “Access denied for orders field”.

What I’m trying to build:
An app that automates Chilean tax document emission (boletas/facturas)
by reading Shopify orders and sending them to Bsale for invoicing.

Question:
Why is read_orders not being applied during install, and how can
I force Shopify to recognize the updated scopes?

Thanks in advance for any help.

2

Have you also requested read_all_orders?

3

Hi @Franciscoaho,

If the access scopes are not being added during the installation, even though you added the scopes in the toml file, it’s likely due to the installation workflow your app is using.

With the Legacy Install Flow as described in the Authorization Code Grant Workflow, the access scopes are requested on install via the actual oauth/authorize HTTP Request parameters.

Where with the Shopify Managed Installation Flow, the access scopes requested on install are taken from the app’s toml file, or configuration in the Dev Dashboard.

You can see which method your app uses in the app’s configuration, either with use_legacy_install_flow: true in the app’s toml file, or in the app’s active version configuration displayed in the Dev Dashboard.

eg:

alt
alt3740×1000 159 KB

Here’s some relevant Shopify.dev documentation on everything I mentioned above:

4

in the app dashboard you need to have api access request of protected customer data access needed

image
image1241×440 34.8 KB

also with read_orders you will only able to access past 60 days orders

to get full access of orders you need this access

image
image1080×205 12.9 KB