Title: How to get read_apps scope approved for a public app?

Shopify Discussion
1

Hi, I’m developing a public app and need to use the appInstallations GraphQL query to retrieve installed apps data. However, read_apps is not available in the scope selector in the Dev Dashboard.

Is read_apps a protected scope that requires special approval? If so, how can I apply for access?

Thanks!

2

Hi, @caowaifei
Yes, read_apps is a Protected Scope.
It is not available by default in the Partner Dashboard’s scope selector because Shopify limits access to a merchant’s installed apps data to protect ecosystem privacy and security.

To use the appInstallations GraphQL query, you must explicitly request approval from Shopify.

How to Apply for Access:

  1. Log in to your Shopify Partner Dashboard.

  2. Go to Apps and select your public app.

  3. Click on Configuration in the sidebar menu.

  4. Scroll down to the Protected customer data / Access Scopes section.

  5. Look for App installations or custom access scopes and click Request access.

  6. You will be asked to provide a business justification. You must clearly explain:

    • Why your app strictly requires knowledge of other installed apps.

    • How this feature benefits the merchant directly.

    • How you plan to handle and secure this data.

Shopify is very strict about granting read_apps. If your app can function without knowing what other apps are installed, or if Shopify thinks you are using it for competitive intelligence, your request will be denied. Ensure your use case is purely functional and essential for your app’s core features.
I hope this will help you.
Thanks!

3

Hello @caowaifei
Yes, read_apps is a protected scope and it is not included by default in the list of scopes. Access is generally granted only after Shopify evaluates your use case in the public app review process, and you’ll need to make a compelling argument why you need the appInstallations data.

Typically teams work around this, under most circumstances, by counting installs via the OAuth install callback, managing their own install registry, then running the app/uninstalled webhook to modify it. That normally meets operational needs without relying on protected scopes.