Confused about access scopes - app seems to be asking for more than I want

Authentication & Access
1

Hey team,
First time developing on Shopify. I am making a simple app that only needs a count for the number of customers and a count for the total number of orders.
Right now in development, I have been getting this data with a REST request:

const ordersResponse = await admin.rest.get({
path: “/admin/api/2024-10/orders/count.json”,
});

This is working. In my shopify.app.toml file, these are the scopes I have requested:
scopes = “read_orders,read_customers,read_all_orders”

First question - do I even need these scopes? From reading the API docs, it looks like I do Order - REST
But I thought I read somewhere else that simply getting the COUNT does not require these scopes?

I have requested the read_all_orders scope and I am waiting to hear back. I want to display a total order count so I think I need this scope to get more than 60 days of data.

Let’s say that I do need read_orders and read_customers just to get the counts. I am confused at the scopes I see when I try to install the app on a development store. I am trying to preview what a merchant would see.

Under View Personal Data, it is showing that I am requesting name, email address, phone, IP, etc etc.

Same with View Store Data, it is showing that I want to view all customer data and order data. I just want to see the counts.

I’d like to keep the scopes as limited as possible to avoid accessing data that I don’t need.

Screenshot 2024-12-11 at 4.43.03 PM
Screenshot 2024-12-11 at 4.43.03 PM542×456 27.5 KB

Am I thinking about this the right way? Any guidance would be appreciated!

2

Hey Limon,

Don’t mean to disrupt your approach too much, but it might be better long term to use the GraphQL API instead of the REST API as we’re deprecating REST.

To retrieve the count of customers and orders, you can use the following GraphQL queries:

1. Count of Customers

Use the customersCount query. This query requires the read_customers access scope.

query GetCustomerCount {
  customersCount {
    count
    precision
  }
}

2. Count of Orders

Use the ordersCount query. This query requires the read_orders access scope.

query GetOrderCount {
  ordersCount {
    count
    precision
  }
}

Hope this helps!

3

Thanks @Liam-Shopify.

Does the screenshot I linked to above match the read_orders and read_customers scopes? It seems much broader - for example, getting customer browser / IP and address, store owner phone / physical address.

I want to limit my access to data to just essentials.

Thanks.