Request only the access scopes that you use

Install AI ToolkitAsk about this pageCopy MD

Request the access scopes that your shipped features use, and remove the rest.

---

Anchor to WhyWhy

Every access scope that your app holds is available to anyone who compromises your app or one of its tokens.

---

Anchor to HowHow

• Review your shopify.app.toml file and remove scopes that no shipped feature uses.
• If only some stores use a feature, then declare the scopes that it needs as optional scopes, and request them when an app user turns the feature on.
• When your app no longer needs an optional scope, revoke it.
• Starting with GraphQL Admin API version 2027-01, your app can also downgrade an optional write scope to read.

---