After the latest update regarding Shopify function logs, the “Share logs” button was removed in the Shopify Admin, and we can now automatically see the logs for which we have the necessary scopes, which is great.
The problem is that when we are missing a single scope of the log, we are blocked completely from seeing the entire function log.
For example: I might need to see the shipping method of a function for debugging, but I won’t be able to do it only because the log also includes the customer email, and I don’t have the “read_customers” scope, even though I don’t need to see customer information data at all.
My feature request is that we should still be able to see the logs, but these logs should have the missing scopes’ data redacted, or something similar.
As a smaller/alternative feature request, it would be great to have an alternative way to get the function logs with the merchant’s consent like the old “Share logs” button, because with the new format, we don’t have any way to see the function logs if the function input has data that the app scopes don’t, even if that data is irrelevant for us.
Similar situation here: we were approved for Protected customer data access, yet our logs recently stopped showing data due to a missing read_customers scope. For what it’s worth, we can already see the PII in checkout extensions and with the read_orders scope, so this requirement doesn’t seem to be doing whatever it was intended to do.
The previous iteration was perfect, we could see logs without requesting additional scopes and any scopes which we didn’t have access to was simply redacted, i.e names and addresses.
With the current iteration, we don’t really want to apply for access scopes as the app doesn’t actually need this to operate - it goes against Shopify’s own policy of only requesting access scopes required to operate, however we now need to request this for the purposes of debugging only, with the ‘share logs’ feature removed, there is no other way to obtain access, in most cases we don’t need to see the information covered by the missing scopes anyway.
The whole thing is a security theater, if you have the read_reports scopes you can still read everything that is being hidden in the function logs and more without having the read_customers or read_orders scopes.
After requesting the minimum customer data necessary to view the logs (email and address) I still can’t see the logs It says I still need the “read_customers” scope:
and ideally we shouldn’t have to apply for PII data just so we can provide support to the merchant? now that the ‘share logs’ button has been removed, there doesn’t seem to be any other way for us to view these logs other than applying for PII and requesting the additional 4 scopes even though they aren’t required for regular use.
Sorry I meant, that if you have read_reports you can read everything using graphql, but function logs will still not show up, meaning that read_payment_customizations and write_payment_customizations are being treated as useless permissions
Also I already added the read_customers scope to my app toml + was approved in the partner customer data request + the merchant accepted the scopes, so it shouldn’t be showing that I need the read_customers scope. This doesn’t make any sense.
Hey @Pridentt - thanks for the detailed examples here. I’m going to raise this internally as two separate pieces: the broader feature request for partial/redacted Function logs when only some scopes are missing, and the specific case where read_customers still appears to be required after you’ve added it, received approval, and had the merchant grant it.
The current log visibility model is based on the scopes required by the function input query, but I definitely get why the all-or-nothing behavior is painful for debugging, especially when the missing data isn’t what you actually need to inspect.
One super quick housekeeping note as well: for future posts, please avoid tagging individual Shopify folks unless they’ve already been involved in the thread, and don’t tag groups. That’s mentioned in our Code of Conduct. No worries this time though - I get the frustration on this one.
For the possible scope-grant issue, could you share the app ID, affected shop, function target, and one affected invocation ID through a private support path? I wouldn’t post those details publicly. That should give the team enough to check whether the dashboard is reading the granted scopes correctly.
Hi @Alan_G, thanks a lot for listening to our concerns here, and sorry about tagging you, but no one from Shopify had responded in 14 days maybe I should have reported it as a bug.
Strangely, for some reason now I can see the logs correctly, maybe there was some update in the dashboard from Shopify’s side?
In case it’s useful, here’s a timeline on what happened:
Initially, I couldn’t see any logs, I got this message in them:
After this, I sent the customer data access request only for email and address (the minimum fields in my function input preventing me from seeing the logs). For some reason, this resulted in us being able to see only some store’s logs, but most still showed that I still needed the read_customers scope, even if they approved the new scopes:
So then I added the read_customers scope to my app’s toml file. After this, I confirmed that the stores that actually approved this new scope, still didn’t let me read the logs, showing the same missing read_customers scope.
After that (today) we got more support tickets, and noticed that the logs were requesting even more scopes: read_payment_customizations and read_products:
I added both scopes to the app’s toml. And after a couple of hours, I’m now able to see the logs, but only for the stores that approved the read_customers scope, which makes sense.
So it seems like the read_customers issue is resolved, though, I can’t tell with a 100% certainty, as we’ve only seen logs from today.
One interesting additional point is that, even though we requested the customer address, it still appears as redacted in the logs. This is not relevant for us, but I thought it was still worth mentioning:
I can’t provide an invocation ID from an affected log now because as I mentioned, it seems like the main problem with the read_customers scope has been resolved, I haven’t found new logs where we can confirm that the store approved the new scope, and the logs were still not showing.
Thanks again @Alan_G, I’ll post again here in case I get new information.
Glad to hear the read_customers visibility issue seems to be behaving now. Since there isn’t a current affected invocation ID, I’d hold off treating that part as an active bug unless it shows up again. If it does, the most useful details to send through a private support path would be the app ID, affected shop, Function target, invocation ID, timestamp, and a screenshot of the missing-scope message. Our frontline folks can usually get in touch with specialists that can investigate further.
That said, I’m still going to keep the broader feature request raised separately: being able to view the allowed portions of a Function log with missing-scope data redacted, or having a merchant-consented log sharing path, would make debugging a lot less painful without pushing apps to request scopes only for support for sure.
Hope this helps a bit as always - let me know if I can answer any other questions or if I’m missing something here
Correct @Pridentt, sorry about the confusion ! They should be able to get you in touch with the right folks, but if you do run into any issues feel free to ping me here and I can take a look for you.
It says I still need the “read_customers” scope:
maybe I should have reported it as a bug.
