What permissions does a shipping app need on Shopify?
A shipping app needs to read orders, act on the fulfillment orders assigned to your own locations, and read your locations. Products and inventory are added when it reads weights or adjusts stock. Access to buyer name, address, phone and email is separate: Shopify reviews and approves that for the app.
What each permission is actually for
| What the app does | Scope | Why shipping needs it |
|---|---|---|
| Read your orders | read_orders | Know what has to ship and where |
| Fulfill from your locations | read and write merchant managed fulfillment orders | Create the fulfillment with tracking |
| See your locations | read_locations | Match the ship from address to the assigned location |
| Read products and variants | read_products | Weights and dimensions for rating |
| Read and adjust stock | read and write inventory | Keep counts right when items are picked |
Shopify separates merchant managed fulfillment orders from work assigned to a fulfillment service or another app, so an app only touches what it should.
The 60 day limit on orders
By default an app can see the last 60 days worth of orders. Wider history needs the read_all_orders scope, which Shopify reviews through the Partner Dashboard before approving. This is why a newly connected shipping app shows you recent orders and not your whole trading history, and it is a Shopify rule rather than a missing feature.
Protected customer data is a separate approval
Buyer name, address, phone and email are protected customer fields, and Shopify calls access to them Level 2. Apps request it through the Partner Dashboard and go through a data protection review before it is approved, and Shopify does not return that data on non development stores until the app is configured and approved.
Shipping is a clear use for those fields, since a label cannot be produced without a name and an address.
What Shopify requires of the app that holds it
The requirements are written as obligations on the app, not on you. Process only the minimum personal data required to provide app functionality, tell merchants what is processed and why, limit processing to those stated purposes, make privacy and data protection agreements with merchants, apply retention periods so personal data is not kept longer than needed, and encrypt data at rest and in transit.
Reading this list is a fair way to judge any shipping app before you install it.
Questions worth asking before you approve
Does it ask for write access to anything beyond fulfillment orders and inventory?
Does it ask for customer data it does not need to produce a label?
Does it say how long it keeps buyer addresses?
Does it explain what happens to your data when you uninstall?
Does the permission list match what the app actually does in your store?
Key takeaways
- Fulfillment orders are a different permission from orders.
- Merchant managed scopes cover the locations you fulfill from yourself.
- Shopify limits apps to the last 60 days of orders unless it approves wider access.
- Protected customer data approval is Shopify's, and it sets rules on the app.
What our Shopify connection asks for
The Shopify connection is in early access. We read orders, products, inventory and locations, and we read and write merchant managed fulfillment orders so the fulfillment with your tracking number can be created against the right one.
Inventory and product writes exist so counts and variant details can be corrected from the packing bench. Recipient fields are removed 90 days after an order is finished, and disconnecting revokes our access at Shopify.
Related questions
Because fulfilling is a write. Creating the fulfillment with the tracking number and carrier, which is what moves the order to Fulfilled and triggers the shipping confirmation, requires write access to the fulfillment orders assigned to your own locations. An app with read access alone can show you orders but cannot close them out.
Shopify presents the app's requested scopes as one set when you install, so it is approve or decline rather than a menu. What you can do is read the list first and judge whether it matches the job. A shipping app should be able to name the feature behind every write permission it asks for.
It has to, to print a label, and that is exactly the data Shopify protects at Level 2. What matters is that the app was approved for it, states its purposes, applies retention periods and encrypts the data at rest and in transit. Those are Shopify's stated requirements for any app holding protected customer fields.
Uninstalling revokes the app's access at Shopify, so it can no longer read orders or create fulfillments. What the app already stored is governed by its retention policy, which Shopify requires it to have. Ask for that policy before you install rather than after, and check whether buyer details are removed on a schedule.