---
title: OAuth scope may be over-requested
description: Detects declared OAuth scopes that don't appear to be used by the app code.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/scope-over-request
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/scope-over-request.md
---

# OAuth scope may be over-requested

Detects declared OAuth scopes that don't appear to be used by the app code.

| Detail | Value |
| - | - |
| Check ID | `SCOPE_OVER_REQUEST` |
| Severity | High |
| How it runs | Agent review |

***

## How to fix

Remove unused scopes or add the code path that needs them.

For more detail, see [Access scopes](https://shopify.dev/docs/api/usage/access-scopes).

Agent review compares the scopes your app declares, usually under `[access_scopes]` in `shopify.app.toml`, with the GraphQL Admin API and REST Admin API calls in your code. It reports two kinds of mismatch:

* A declared scope that no code uses, such as `read_analytics` when nothing queries analytics.
* An API call that needs a scope the app doesn't declare, such as a customer query without `read_customers`.

An app with no source files isn't reported for over-requested scopes, because there's no code to compare the scopes against.

**Don’t**

* Request a scope now because a feature might need it later.
* Call an API resource without declaring the scope it needs.
* Remove a scope based on a text search alone. Wrappers, generated queries, and background jobs can use a scope without naming its resource.

**Do**

* Request the scopes your shipped features use, and remove the ones you no longer need.
* Declare the scope for every resource your code reads or writes.
* Before you remove a scope, check wrappers, generated queries, and background jobs for code that uses it.

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***