Fulfillment service creation fails with 'Access denied for location field' despite correct scopes and fresh install

GraphQL Admin API Troubleshooting
1

We’re developing a Shopify Fulfillment Service app using the fulfillmentServiceCreate mutation via the Admin GraphQL API. The mutation fails with the error:

Access denied for location field. Required access: read_locations access scope, read_inventory access scope or read_markets_home access scope.

The mutation we send includes a locationId, and we also query fulfillmentService { id location { id } } in the response.

The app is built with @shopify/shopify-app-remix, using unstable_newEmbeddedAuthStrategy: true. All required scopes are declared in both the .env and shopify.app.toml, including read_locations. The app has been freshly installed on a development store after full uninstallation. The OAuth flow appears to complete successfully, and other queries work.

We have also verified that read_locations is listed in the configured scopes in the Partner Dashboard.

Despite this, the same GraphQL mutation consistently fails when accessing the location field in the response. The fulfillment service is not created.

Is there any known issue with access to location in this context or with scope propagation during reinstallation?

1 Like
2

Hey @Markus, I’m happy to take a look in to this with you.

Can you confirm that the store has approved the read_locations access scopes?

{
    currentAppInstallation {
        accessScopes {
            handle
        }
    }
}

Another thing to check is in your app configuration file, make sure you have enabled direct API mode https://shopify.dev/docs/apps/build/cli-for-apps/app-configuration#access.

3

Hi Kyle from what i can see the scopes are approved . the wstarange thing is all write sopes are there bur all read scopes are not. We build a debug to check the installation scopes and it gives back all the scopes in the toml but the session scopes are only the write scopes.

4

That is strange. Can you share your current app toml file (please redact identifying information like app id, url, etc)?

Can you also check the latest release in the version tab of the partner dashboard. You can double check the current scopes deployed with your app version.