Access denied for product field. Required access: `read_products` access scope.

[mritunjay4ever]

Hi I am trying to fetch the metafields for a particular product from admin API but failing to do so

{
  product(id: "gid://shopify/Product/6781936599084") {
    metafield(namespace: "reviews", key: "review1") {
      value
      key
      id
    }
  }
}

it is giving me error

{
  "data": {
    "product": null
  },
  "errors": [
    {
      "message": "Access denied for product field. Required access: `read_products` access scope.",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "product"
      ],
      "extensions": {
        "code": "ACCESS_DENIED",
        "documentation": "https://shopify.dev/api/usage/access-scopes",
        "requiredAccess": "`read_products` access scope."
      }
    }
  ],
  "extensions": {
    "cost": {
      "requestedQueryCost": 2,
      "actualQueryCost": 1,
      "throttleStatus": {
        "maximumAvailable": 1000,
        "currentlyAvailable": 941,
        "restoreRate": 50
      }
    }
  }
}

   I have also given access to read and write products

and when I am running the same query from storefront api it is running properly and giving me correct response. But I can't able to update the metafields from storefront so asking for help.

[ShopifyDevSup]

Hi @mritunjay4ever 👋

Would you please try the below query to verify that your current token has the `read_products` scope?

{
    currentAppInstallation {
        accessScopes {
            handle
        }
    }
}

[mritunjay4ever]

It is giving me this

{
  "data": {
    "currentAppInstallation": {
      "accessScopes": [
        {
          "handle": "unauthenticated_read_product_listings"
        },
        {
          "handle": "unauthenticated_read_product_tags"
        },
        {
          "handle": "unauthenticated_write_checkouts"
        },
        {
          "handle": "unauthenticated_write_customers"
        },
        {
          "handle": "unauthenticated_read_customer_tags"
        },
        {
          "handle": "unauthenticated_read_content"
        },
        {
          "handle": "unauthenticated_read_checkouts"
        },
        {
          "handle": "unauthenticated_read_customers"
        }
      ]
    }
  },
  "extensions": {
    "cost": {
      "requestedQueryCost": 2,
      "actualQueryCost": 2,
      "throttleStatus": {
        "maximumAvailable": 1000,
        "currentlyAvailable": 998,
        "restoreRate": 50
      }
    }
  }
}

[mritunjay4ever]

@ShopifyDevSup  Any reply will be helpful as I am stuck.

[ShopifyDevSup]

Hi @mritunjay4ever, it doesn't appear that the app has the 'read_products' access scope enabled. If it was working you could expect to see the response as per the example here, https://shopify.dev/api/admin-rest/2022-10/resources/accessscope, 

HTTP/1.1 200 OK
{
 "access_scopes": [
   {
     "handle": "read_products"
   }
 

[ShopifyDevSup]

If you can't resolve why the scopes aren't being added you could try to reach out to our Partner support and provide details of the app so they can check the internal status. 

[st_consult]

I had the same problem with the access to metaobjects. For those who have difficulties understanding the official documentation (like me 🙂 )
The point is that you're looking at the wrong place: The definition for what your app is allowed to do is defined in your partner account:
In your partner account, go to 'Apps --> <your app's name>'. Then select the navigation entry 'API access'. In the card 'Scopes' you find the currently defined scopes.
To change these scopes, you have to edit the file 'shopify.app.toml' in the folder of your app source code. There is a config entry `access_scopes` in which you add the scopes you need. In my case, it had to be:

[access_scopes]
scopes = "write_products,write_metaobjects"

Then update the settings by calling this:

shopify app config push

 
Then you restart your app. Very likely, in the Shopify admin UI, you (or your merchant) have to update the app because it is granted more permissions now. But that's just a few of the standard clicks, similar to installing the app.