StaffMember Permissions is Deprecated. What to Use Instead?

GraphQL Admin API Troubleshooting
1

We have a shop that wants us to add per user permission to an app based on the logged in user’s Shopify permissions but I see that the StaffMember.privateData.permissions is deprecated with no alternative.

Given this how can one implement per user permission to an app based on the logged in user’s Shopify permissions? It looks like Shopify is planning to no longer make this possible.

2

Hey @sshaw, the best way to manage this is with online access tokens. When you use this, the access token is linked to the individual logged in user.

Online access is meant to be used when a user is interacting with your app through the web, or when an app must respect an individual user’s permission level.

3

Thanks but after they log in I need to get the user’s permissions. As far as I know this is not transmitted with OAuth and you have to use the API which is deprecated.

4

@sshaw StaffMember.privateData.permissions is already returning errors even with read_users scope. For per user scope though, that is returned with the online access token. You can see the example response here in the associated_user_scope field.

{
  "access_token": "f85632530bf277ec9ac6f649fc327f17",
  "scope": "write_orders,read_customers",
  "expires_in": 86399,
  "associated_user_scope": "write_orders",
  "associated_user": {
    "id": 902541635,
    "first_name": "John",
    "last_name": "Smith",
    "email": "john@example.com",
    "email_verified": true,
    "account_owner": true,
    "locale": "en",
    "collaborator": false
  }
}
5

Great. Thanks for clarifying! :+1: