Hi Shopify team,
I’m the store owner of simonsaboragol.myshopify.com. I have a custom app called “Simon Uploader”, created and managed in the new Dev Dashboard, installed on my own store within my own organization.
The app needs Admin API access to orders and customers (scopes read_orders, write_orders, read_customers, read_fulfillments). The scopes are already added to the app, and I can successfully obtain an access token via the client credentials grant — but the granted scopes exclude all protected-customer-data scopes, and calls to /admin/api/2026-04/orders.json return:
403 — "[API] This action requires merchant approval for read_orders scope."
The problem: there is no UI option to request or approve Protected Customer Data access for this app. In the new Dev Dashboard the app only exposes Monitoring / Logs / Versions / Configuration — there is no “API access requests” or “Protected customer data” section. The Partner Dashboard no longer has “Apps → API access requests” either (it redirects everything to the Dev Dashboard). This matches the known issue reported by other developers (“Cannot Request Protected Customer Data Access in New Dev Dashboard”).
Could you please enable Protected Customer Data access (Level 1 + Level 2, fields: name, email, phone, address) for this app? It’s a single-store custom app on my own store, used for order fulfillment management and customer support. I’m happy to complete any data-protection attestation.
- Store:
simonsaboragol.myshopify.com
- App: Simon Uploader
- API version:
2026-04
Thank you!
Hey @Jose_Leonardo_Portil - thanks for reaching out.
I dug into this and have some helpful context to share with you. To start, a custom app installed on your own store within your own organization already has protected customer data access enabled by default. Custom apps get Level 1 and Level 2 PCD automatically, so there’s no request, approval, or data-selection step for you to find with regard to protected customer data. That missing UI isn’t what’s blocking you, which is part of why this error is so confusing.
The 403 This action requires merchant approval for read_orders scope error you’re seeing really just means the token you’re using doesn’t have read_orders in its granted scopes yet in this case. This is unintuitive error messaging and I’m going to make sure feedback about this is heard.
If you’ve already added the read_orders scope to your app, it may be that the grant on the install has to be refreshed before read_orders shows up on your token.
Here’s the sequence you can follow:
- Add read_orders (and any other scopes you need) to the app’s configuration.
- Release a new version of the app so the scope is part of the active version (for example,
shopify app deploy).
- Re-run the install/grant once so the existing install picks up the new scope. A shopify app dev session does this automatically, or you use the
Install app button in the app page of your dev dashboard. This updates the grant in place and will add the updated scopes pending your approval
Once that’s done, your existing client credentials token should update with the read_orders scope and you should be able to query data that requires the scope without seeing the error message.
Hope this helps!
same issue here. We were trying to find how to do this for some time.
Thanks for reaching out @Shan_Chaudary. Were you able to look over the troubleshooting steps I included above? Only public apps associated with a partner organization require a review to access protected customer data:
If you’ve created your custom app in the dev dashboard associated with your merchant organization (accessed through the admin of a shop) - you don’t need to request a review. If you’re seeing the 403 This action requires merchant approval for read_orders scope or similar error, it may be that your app need to declare and authorize the scope specifically.
If you (or @Jose_Leonardo_Portil) are still running into this error message, please share an x-request-id value from the headers of the response of a request that returned this error message and I can definitely take a look.
Thanks!