Incorrect write-access disclosures shown on app listing

Shopify App Store
1

Hi Shopify team,

We are seeing inconsistencies between the data access disclosures shown on our app listing and the access scopes declared in our app’s TOML file. This has already caused some merchants to hesitate or decide not to install our sales channel app.

On our app listing, merchants see a disclosure that suggests the app requires write access to several types of data, including products, collections, locations, product and variant inventory, and in-store pickup availability:

Screenshot 2026-07-01 at 09.46.02
Screenshot 2026-07-01 at 09.46.021686×936 96.3 KB

However, our declared access scopes are:

[access_scopes]
scopes = "read_locations, read_product_listings, read_products, read_shipping, unauthenticated_read_product_inventory, unauthenticated_read_product_listings, unauthenticated_read_product_pickup_locations, write_resource_feedbacks, read_publications, write_publications, read_orders"

The only two write scopes are:

write_publications
write_resource_feedbacks

In our view, both are expected for a sales channel app:

  • write_publications is needed so merchants can publish products to our sales channel.
  • write_resource_feedbacks is needed so we can provide feedback when a product cannot be accepted or published on the channel.

We do not request write access to products, collections, locations, inventory, variants, or pickup availability.

One merchant therefore understandably asked us why the app needs write access to products, collections, locations, product and variant inventory, product in-store pickup availability, and locations. Based on our actual access scopes, the app does not need or request write access to these entities.

We believe the current data access disclosure is misleading and creates unnecessary concern for merchants. For us, this is a serious issue because we increasingly see merchants being scared off by what appears to be a much broader write-access requirement than the app actually has.

Could you please clarify why the listing shows these write-access disclosures, and whether this can be corrected so that the displayed permissions accurately reflect the scopes declared in the app TOML?

Best,
Angelo

2

Hey @angelo - thanks for reaching out. If you’re open to sharing your app ID I can take a look into this for you. Let me know if you’d rather set up a DM and I can create one on my end here to share that info.

3

Hey @Alan_G, here’s our app ID: 71381876737. Thanks!

4

Hi @Alan_G, do you have any updates on this topic? Do you need any more information from me?

5

Hey @angelo - thanks for following up.

I’ve confirmed that this is related to how the scopes are grouped for display, rather than your app requesting those additional write scopes. We’re looking a bit more into things on our end here, sorry for the delay.

I don’t have a timeline for a change yet, but I’ll keep you in the loop here.

7

Hi @Alan_G,

I see that the scopes’ display has improved in the meantime.

Screenshot 2026-08-11 at 16.48.23
Screenshot 2026-08-11 at 16.48.231482×874 95.6 KB

Thanks a lot for this improvement! This should address one of our customers’ most urgent concerns.

However, the last section, ‘Edit other data’, remains confusing. It suggests that all the data types in this section can be edited, but only resource feedbacks and publications on this sales channel can be edited. One suggestion would be to split this section into two: one for viewing data and one for editing data.

View other data
Locations, product and variant inventory, product in-store pickup and availability and locations

Edit other data
Publications of products on this sales channel, resource feedbacks for this sales channel

Best, Angelo

8

Hey @angelo - thanks for following up and for sharing the updated screenshot. Glad we could help a little bit!

I definitely agree that the remaining “Edit other data” grouping could still potentially imply broader write access than the scopes actually grant. Just confirming that your app’s write access here is limited to publications and resource feedbacks; the locations, inventory, and pickup-related access shown is read-only.

I’m looping this remaining grouping issue back internally with your suggested View/Edit split. I can’t guarantee anything, I’ll keep you updated here once I have more info.