---
title: Scope every query to the authenticated shop
description: >-
  Look up every record by the authenticated shop and the record's ID together,
  never by the ID alone, so another store's ID returns nothing.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/backend/scope-queries-to-the-authenticated-shop
  md: >-
    https://shopify.dev/docs/apps/build/security/backend/scope-queries-to-the-authenticated-shop.md
---

# Scope every query to the authenticated shop

Look up every record by the authenticated shop and the record's ID together, never by the ID alone.

***

## Why

Most Shopify apps serve many stores from one database. A request that names an order, customer, file, or other record by ID carries a value the sender controls. If your code fetches the record by ID alone, then a request with another store's ID returns that store's data. This is an insecure direct object reference (IDOR).

***

## How

Apply these four steps to every request that touches store data:

1. Authenticate the request using a Shopify-issued token or a validated signature. See [Authenticate every request](https://shopify.dev/docs/apps/build/security/backend/authenticate-every-request).
2. Derive the shop from that authenticated identity, not from the request.
3. Confirm that the requested resource belongs to that shop, by querying for the shop and the ID together so that another store's ID returns nothing.
4. Confirm that the caller has permission to perform this specific action.

Apply all four steps everywhere, not only on your internet-facing API. Background jobs, webhook handlers, CSV exports, file downloads, GraphQL resolvers, and internal admin tools touch the same data.

***