OAuth scope may be over-requested
Detects declared OAuth scopes that don't appear to be used by the app code.
| Detail | Value |
|---|---|
| Check ID | SCOPE_OVER_REQUEST |
| Severity | High |
| How it runs | Agent review |
Anchor to How to fixHow to fix
Remove unused scopes or add the code path that needs them.
For more detail, see Access scopes.
Agent review compares the scopes your app declares, usually under [access_scopes] in shopify.app.toml, with the GraphQL Admin API and REST Admin API calls in your code. It reports two kinds of mismatch:
- A declared scope that no code uses, such as
read_analyticswhen nothing queries analytics. - An API call that needs a scope the app doesn't declare, such as a customer query without
read_customers.
An app with no source files isn't reported for over-requested scopes, because there's no code to compare the scopes against.
Don’t
- Request a scope now because a feature might need it later.
- Call an API resource without declaring the scope it needs.
- Remove a scope based on a text search alone. Wrappers, generated queries, and background jobs can use a scope without naming its resource.
Do
- Request the scopes your shipped features use, and remove the ones you no longer need.
- Declare the scope for every resource your code reads or writes.
- Before you remove a scope, check wrappers, generated queries, and background jobs for code that uses it.
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?