Trust & security

Shopify App Permissions

A plain-English explanation of every Shopify Admin API permission FeedGraph requests, what it can access, and why the platform cannot work without it. Nothing is requested in the background or added later without you seeing it.

Last updated 2026-09-09

How FeedGraph connects

FeedGraph connects with Shopify OAuth, or with a client-credentials app you create in the Shopify Dev Dashboard and install on the store. No store password is stored. The access token is what governs access, and it is stored encrypted.

Default scopes are: read_products, write_products, read_inventory, write_inventory. If a reconnect is missing one of these, the app tells you which, and push-back to Shopify stays disabled until write_products is granted.

You can disconnect from Shopify admin at any time. Access ends when you uninstall or revoke the app — you do not need a FeedGraph login to do that.

Permissions we request

These four Admin API scopes are required for a working sync. That is the same list the product checks after connect.

read_products
Read the product catalogue: titles, descriptions, variants, images, SKUs, and related product fields. Used by the master feed, scoped import, hourly poll, and Bulk Operations reconcile. Without it the store looks empty and sync cannot start.
write_products
Create or update products and variants when you approve a push back to Shopify — for example an enrichment you reviewed, a field fix, or a product FeedGraph is publishing to the store. FeedGraph does not silently rewrite the live catalogue; writes follow the approval and sync paths in the app. If this scope is missing, inbound sync can still run and outbound updates cannot.
read_inventory
Read stock levels and inventory items so availability in FeedGraph and in channel feeds matches the store. Listings that say “in stock” when they are not get rejected or waste spend.
write_inventory
Update inventory items when a reviewed sync needs to write availability back to Shopify. Paired with write_products so quantity and product data stay aligned. Not used to alter orders or customer records — FeedGraph does not request those APIs.

What we do not ask for

FeedGraph does not request access to Shopify customers, orders, checkout, gift cards, or Shopify Payments. Revenue figures used for advertising intelligence come from connected ad platforms as aggregate SKU and campaign metrics, not from Shopify order PII.

We do not ask for store staff passwords, and we do not add extra scopes after install without a new authorisation.

How the data is used

Imported catalogue data becomes the workspace master list. From there you validate against Google and Meta rules, optionally enrich with AI (only if that consent is on), generate feeds, and attach creatives.

Three sync layers keep the list current: Shopify webhooks for near-real-time changes, hourly incremental polling, and a deeper Bulk Operations reconcile for large catalogues. You can limit which SKUs are in scope so a full store is not pulled by default.

Tokens never leave the encrypted credential columns except to call Shopify on your behalf. They are workspace credentials, not an individual’s personal data, and they are revoked when you disconnect.

Google and Meta are separate

Advertising connections are not Shopify permissions. Google Ads uses its own OAuth (Ads API plus basic profile/email to identify the Google account). Meta uses ads_read, ads_management, catalog_management, business_management, and pages_read_engagement when you connect a Meta ad account. Read of performance is the default path; writes that change campaigns still go through FeedGraph’s approval workflow.

Questions

If a scope looks wrong on a connected store, reconnect from the integrations screen so Shopify shows the current list. For a vendor review, use the contact form or the Security page.

This page describes how FeedGraph actually operates. It is written in plain language and pending external legal review. If something here conflicts with a signed order form or data processing addendum, the signed document wins.