Bug Report: Cannot Request Protected Customer Data Access in New Dev Dashboard

Authentication & Access
,
1

I am using Shopify (Next-Gen Dev Platform). The app requires access to the FulfillmentOrder object via the Admin GraphQL API. However, I am encountering an ACCESS_DENIED error due to protected customer data restrictions, and there is no visible way to request access to this data in the new Dev Dashboard UI.

Steps to reproduce

  1. Create an app using the new Dev Dashboard (not the Partner Dashboard).

  2. Install the app on a store and grant all relevant fulfillment and order scopes (e.g., read_assigned_fulfillment_orders, read_merchant_managed_fulfillment_orders, read_third_party_fulfillment_orders).

  3. Attempt to query the fulfillmentOrders object via the Admin GraphQL API in local GraphQL explorer, e.g.:

    query FulfillmentOrdersCountQuery {
 fulfillmentOrders(
   first: 250
 ) {
   edges {
     node {
       id
     }
   }
 }

}


4. Receive the following error response:

```json
{
  "errors": [
    {
      "message": "This app is not approved to access the FulfillmentOrder object. See https://shopify.dev/apps/store/data-protection/protected-customer-data for more details.",
      "locations": [
        {
          "line": 2,
          "column": 5
        }
      ],
      "path": [
        "fulfillmentOrders"
      ],
      "extensions": {
        "code": "ACCESS_DENIED",
        "documentation": "https://shopify.dev/apps/store/data-protection/protected-customer-data"
      }
    }
  ],
  "data": null
}
  1. Search the Dev Dashboard for any UI or workflow to request access to protected customer data (as is possible in the Partner Dashboard). No such option is found.

Expected behavior

  • There should be a clear way to request access to protected customer data (such as the FulfillmentOrder object) for apps built and managed in the new Dev Dashboard, similar to the process available in the Partner Dashboard.

Actual behavior

  • All attempts to access the FulfillmentOrder object result in an ACCESS_DENIED error, even with all required scopes and correct authentication.

Questions

  • How can devs using the new Dev Dashboard request access to protected customer data? is it required ?
  • Is there a current process or workaround for this, or is it not yet supported in the Dev Dashboard Beta?
  • If not supported, is there an ETA or recommended path for apps that need this access?

Thank you for your help and clarification!

2

To request access to protected customer data (PCD) for an app created in the Dev Dashboard you will still need to use the partner dashboard. If you are in the apps list for the partner dashboard there is a separate list of Dev Dashboard apps. Once you click into one of those apps go to API Access Requests and there you can request PCD, the same as for apps created in the partner dashboard.

image
image3108×1608 389 KB

3

Amazing didn’t know that, nor saw it in docs, I thought dev dash replaced all of partner dash. Thanks!

1 Like
4

@TerenceShopify Just a note on this, I can no longer request or see the Protected Customer Data setting on apps that are not created via the new Dev environment.

Even though these apps already have it granted, i can’t review it or add it to new apps, I can only see it as an option on apps that are created via the ‘new dev’ environment?

If I create the app on the new dev environment, while it’s running in dev mode, I see the Protected Customer Data options, however, the second I deploy it and distribute it (non public), those settings disappear again?

1 Like
5

If you distribute a custom app it will automatically have access to protected customer data. Only public apps require you to submit the form and request access. There are no changes to this experience with the new Dev Dashboard.

1 Like
6

Hi!
I’m using the non-beta App Partner program, and I have a custom application in which I want to access protected customer data. You’re saying it’s enabled by default, but the API is returning:

RequestError: This app is not approved to use the firstName field. See Work with protected customer data for more details

And it’s impossible to locate the “Protected customer data” section on my application dashboard.

The app distribution is limited to my Shopify Plus customer stores under an organization.

Any idea?

7

Have you already distributed your app as a custom app? If you can share your app ID I can look into it a bit more.

8

Yes, I choose “Custom distribution”
Here is my app id: 250292731905 :slight_smile:

9

Thanks. I can see the app is custom and it looks like is has permissions set properly for protected customer data on our side. Can you share more details of the API request that’s failing?

10

It occurs when I try to use the customerSet mutation with variables:

const customerSetInput = {
    identifier: {
      email: ...,
    },
    input: {
      addresses: [...],
      email: ...,
      firstName: ...,
      lastName: ...,
      tags: [],
    },
  };

And mutation:

mutation customerSet($identifier: CustomerSetIdentifiers, $input: CustomerSetInput!) {
      customerSet(identifier: $identifier, input: $input) {
        customer {
          id
          email
          firstName
          lastName
          createdAt
        }
        userErrors {
          field
          message
        }
      }
    }
11

any updates on this? Its kind of annoying that I have to choose distribution first (and that I have to do it in the partners dashboard); is the plan to eventually allow for configuring CDP in the dev dashboard?

12

Approval scopes including protected customer data continue to be requested in the partner dashboard. I can appreciate that it’s a bit disjointed at the moment.