Incorrect write-access disclosures shown on app listing

Shopify App Store
1

Hi Shopify team,

We are seeing inconsistencies between the data access disclosures shown on our app listing and the access scopes declared in our app’s TOML file. This has already caused some merchants to hesitate or decide not to install our sales channel app.

On our app listing, merchants see a disclosure that suggests the app requires write access to several types of data, including products, collections, locations, product and variant inventory, and in-store pickup availability:

Screenshot 2026-07-01 at 09.46.02
Screenshot 2026-07-01 at 09.46.021686×936 96.3 KB

However, our declared access scopes are:

[access_scopes]
scopes = "read_locations, read_product_listings, read_products, read_shipping, unauthenticated_read_product_inventory, unauthenticated_read_product_listings, unauthenticated_read_product_pickup_locations, write_resource_feedbacks, read_publications, write_publications, read_orders"

The only two write scopes are:

write_publications
write_resource_feedbacks

In our view, both are expected for a sales channel app:

  • write_publications is needed so merchants can publish products to our sales channel.
  • write_resource_feedbacks is needed so we can provide feedback when a product cannot be accepted or published on the channel.

We do not request write access to products, collections, locations, inventory, variants, or pickup availability.

One merchant therefore understandably asked us why the app needs write access to products, collections, locations, product and variant inventory, product in-store pickup availability, and locations. Based on our actual access scopes, the app does not need or request write access to these entities.

We believe the current data access disclosure is misleading and creates unnecessary concern for merchants. For us, this is a serious issue because we increasingly see merchants being scared off by what appears to be a much broader write-access requirement than the app actually has.

Could you please clarify why the listing shows these write-access disclosures, and whether this can be corrected so that the displayed permissions accurately reflect the scopes declared in the app TOML?

Best,
Angelo

2

Hey @angelo - thanks for reaching out. If you’re open to sharing your app ID I can take a look into this for you. Let me know if you’d rather set up a DM and I can create one on my end here to share that info.

3

Hey @Alan_G, here’s our app ID: 71381876737. Thanks!