Access scopes declared in the active app version are not reflected in issued Admin API access tokens

[sabangnet_dev]

• Store: kabrita-kr.myshopify.com
• App: 사방넷연동(편한가직접설정) — custom distribution app
• App version: version-4 (active), embedded: false, use_legacy_install_flow: false
• API version in use: 2026-04

[What we did]

1. We updated the app’s Admin API access scopes in version-4 to the following 24 scopes and released that version (it is shown as the active version — screenshot attached):

   

   write_assigned_fulfillment_orders, read_customers, write_customers, write_files,
   read_fulfillments, write_fulfillments, write_inventory, read_locations,
   write_merchant_managed_fulfillment_orders, write_order_edits, read_order_edits,
   read_orders, write_orders, read_product_listings, write_product_listings,
   read_products, write_products, read_publications, write_publications, read_returns,
   write_third_party_fulfillment_orders, customer_read_companies,
   customer_write_companies, customer_read_orders, customer_write_orders

2. We then issued a NEW Admin API access token using the existing Client ID and Client secret.

[What we observe]

1. GET https://kabrita-kr.myshopify.com/admin/oauth/access_scopes.json with the newly issued token returns only 9 read scopes — none of the write scopes are present:

   read_assigned_fulfillment_orders, read_customers, read_inventory, read_locations,
   read_merchant_managed_fulfillment_orders, read_orders, read_products, read_returns,
   read_third_party_fulfillment_orders

   

2. As a result, the fulfillmentCreate mutation still fails:

   “Access denied for fulfillmentCreate field. Required access:
   write_assigned_fulfillment_orders access scope,
   write_merchant_managed_fulfillment_orders access scope or
   write_third_party_fulfillment_orders access scope.
   Also: The user must have fulfill_and_ship_orders permission.” (ACCESS_DENIED)

   Read operations (order / fulfillmentOrder queries) succeed normally with the same token.

3. Notably, the access token that was issued BEFORE the scope update is still valid and returns exactly the same 9 scopes. Since Shopify revokes previously issued offline tokens when an app is reinstalled or re-authorized, this suggests that the granted scopes on this installation were never updated — newly issued tokens appear to simply inherit the existing, outdated grant.

[Questions]

1. Why does the token still have only the old 9 read scopes, even though version-4 is the active version and it declares 24 scopes?

2. After changing the scopes, does the merchant have to approve the new permissions somewhere? If yes, where exactly? This app is not embedded, so there is no app page to open inside the Shopify admin.

3. Is there a URL we can open to re-approve the permissions? For example:
   https://admin.shopify.com/store/kabrita-kr/oauth/install?client_id=…
   Please tell us the exact URL to use.

4. Can the staff account that installed the app limit which scopes are granted? The error message also mentions the fulfill_and_ship_orders permission. If this matters, please tell us which staff account installed this app and which permissions that account needs.

5. Is there anything else we must do to make the new scopes take effect? Please give us the full steps in order.

Thank you.

[Yoni-Shopify]

Hi @sabangnet_dev

Yes, the added scopes need to be approved on the store. For your non-embedded app, try the explicit installation flow to check whether that approval is pending:

1. In Dev Dashboard, open the app’s Home page → Distribution → Manage custom install link, and generate the link for kabrita-kr.myshopify.com. These are the custom-distribution steps.
2. Have the store owner open that link. If Update data access appears, review and approve the additional permissions.
3. Obtain a fresh token through your existing authentication flow, then repeat your /admin/oauth/access_scopes.json request. Check whether the fulfillment write scopes are now present.

You don’t need to uninstall the app to try this.

An older token remaining valid doesn’t prove that reauthorization failed. That depends on the token type and lifecycle, so the granted scope list is the useful check here.

Staff permissions can additionally limit an online token’s access. However, the error alone doesn’t establish a staff-permission problem or identify who installed the app.

If the link doesn’t show an approval screen, or the write scopes remain missing afterward, please contact Shopify Support while signed in to the affected store and include this thread. Include the token-request method or grant type, with credentials removed, so Support can check the installation and account permissions.