Can a Customer Update App with New Permissions?

[BotNot]

We have updated our permissions to add a new feature to our customers and I saw there is no way for customers to update and accept the new permissions. Is the only possible way to uninstall the App then re-install it?

[HunkyBill · Accepted solution]

Strange. This is 100% built-in to the Shopify App. You notice in the configuration the "authenticate on scope change" setting and set that to true. When an App install is approved, the scopes are saved along with the access token. So when you change App scopes, a little routine compares the provided App scopes with the ones you previously saved. If they differ and it means the merchant needs to re-approve the scope changes, the App just redirects to that page asking the merchant if they approve. If they do, the new scopes get saved in the DB, and you're golden. There is NO WAY you want the merchant uninstall and re-install.

This has been in the code for about a year now or more. I am not sure when it was actually added but the Github repo clearly shows this change. Just follow that recipe if you rolled your own App.

[tejasvyas]

Hi, I was not able find the setting "authenticate on scope change" in the app configuration. Can you please share details on this e.g. path and how this can be implemented?

[HunkyBill]

Handling Access Scope Changes 

[Dynasort]

Yes it's totally possible, all of our new apps are built with this in mind. You'll need to redirect them to the OAuth page where they accept permissions again for the process, but you can keep their current charge associated with the app install.

[BotNot]

Thank you both so much - we are investigating this now!

[HunkyBill]

@BotNot I just had to say, since I released a pretty damn sophisticated App with some dudes that prevent Bots from buying Shopify products and your handle is very appropriate to that concept. It's a wonder I never thought of that before myself. Botnot... works for me, but instead, it works for you!