---
title: Request only the access scopes that you use
description: >-
  Request the access scopes that your shipped features use, declare
  feature-specific scopes as optional, and revoke scopes you no longer need.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/request-only-the-scopes-you-use
  md: >-
    https://shopify.dev/docs/apps/build/security/credentials-and-data/request-only-the-scopes-you-use.md
---

# Request only the access scopes that you use

Request the access scopes that your shipped features use, and remove the rest.

***

## Why

Every access scope that your app holds is available to anyone who compromises your app or one of its tokens.

***

## How

* Review your `shopify.app.toml` file and remove scopes that no shipped feature uses.
* If only some stores use a feature, then declare the scopes that it needs as [optional scopes](https://shopify.dev/docs/apps/build/authentication-authorization/manage-access-scopes#optional_scopes), and request them when an app user turns the feature on.
* When your app no longer needs an optional scope, [revoke it](https://shopify.dev/docs/apps/build/authentication-authorization/manage-access-scopes#revoke-granted-scopes-dynamically).
* Starting with GraphQL Admin API version `2027-01`, your app can also [downgrade an optional write scope to read](https://shopify.dev/changelog/downgrade-app-access-scopes-from-write-to-read).

***