write_fulfillments app scope update on existing stores not working

Shopify Apps

Topic summary

Attempt to add the write_fulfillments permission to already-installed Shopify app stores via an emailed OAuth reauthorization URL fails with state-related errors. The constructed /admin/oauth/authorize link without a state returns “Value null at ‘state’ must not be null.” Supplying a state then returns “Requester does not have a valid state to complete OAuth.”

By contrast, the same approach with other scopes (write_inventory, write_products, write_shipping, write_third_party_fulfillment_orders) redirects to the consent page, even without a state. The poster references Shopify docs on OAuth redirects and known issues around FulfillmentOrder scopes and asks if those issues also affect write_fulfillments.

Key questions:

  • Why does write_fulfillments not redirect while other scopes do?
  • Why is a non-null state required only for write_fulfillments?
  • If state is mandatory, how to generate/validate it when building URLs outside the app (for email reauth links)?

Notes: Code snippets/URLs are central. “state” refers to the OAuth anti-CSRF token. No resolution or workaround provided; issue remains open.

Summarized with AI on January 18. AI used: gpt-5.
1

I have an app with some scopes and need to add the write_fulfillments

scope on already installed app without asking the store owners to uninstall and reinstall.

Have constructed the below url referring to guidance here,


[https://](https://{shop}.myshopify.com/admin/oauth/authorize?client_id={client_id}&scope={scopes}&redirect_uri={redirect_uri}&state={nonce}&grant_options[]={access_mode)<store>.myshopify.com/admin/oauth/authorize?client_id=<clientId>&scope=**write_fulfillments**&redirect_uri=<redi_uri>

and getting failure response as


{"message":"1 validation error detected: Value null at 'state' failed to satisfy constraint: Member must not be null"}

then I added the state and got the following failure response :


{"message":"Requester does not have a valid state to complete OAuth"}

Did the same experiment on multiple other scopes like write_third_party_fulfillment_orders and was successful redirected to the consent page (without the state in the URL).

Questions :

  1. Why is the url not redirecting for write_fulfillments scope while it is working for many other scopes like write_inventory, write_products, write_shipping, write_third_party_fulfillment_orders

  2. Why is url with **write_fulfillments** scope required to have a non null state ? while others didn’t require it.

I see there are some known issues (Ref) when updating the FulfillmentOrder scopes but does it also impact write_fulfillments scope ? and what is the workaround for it ?

  1. If state is mandatory for some reason for **write_fulfillments** scope addition how can i get the value of the state if i am generating the url outside of my app code.

I intend to email these reauth URLs to store owners so that they can get the write_fulfillments scope added. Please let me know if I am missing something.

Regards