Shopify's new app security view: what Restock Ops can access
Settings > Apps now shows each app's permissions, activity and token type. How to read that panel for Restock Ops, and why an inventory app reads orders.
In early November 2026 Shopify changed what you see when you open Settings > Apps and click an installed app. Alongside the familiar permissions list there is now a security view: what kind of data the app can reach, whether it is flagged as touching sensitive data, whether its access tokens expire, whether its API calls are locked to declared IP addresses, and a recent activity summary of what the app actually did. It is the first time most merchants have had a way to compare what an app asked for with what it uses.
That comparison is what this post is about. Restock Ops asks for eleven permissions, one of which is read access to orders, and an inventory app wanting to read orders is exactly the kind of line that deserves a question. Below is every scope, what it is used for, what the activity panel should show for each, and what it should not. If something in your panel does not match, that is worth a support message, and we would rather you sent it than wondered.
How to find the panel
Open Settings, then Apps and sales channels, then click Restock Ops. The permissions section lists the scopes the app was granted. The security and activity information sits with it, and Shopify's own guide to managing apps explains the general layout. Shopify groups scopes into readable labels, so you will see phrases like View products and Edit inventory rather than the raw names; the table below gives both, because the raw names are what the activity data is keyed to.
The eleven scopes
Shopify calls permissions access scopes, and every one an app can request is documented on the access scopes reference. Restock Ops requests these.
| Scope | What Restock Ops does with it | When you should see activity |
|---|---|---|
| read_products | Reads variant titles, SKUs, barcodes, vendors and prices to build supplier item lists, purchase order lines and barcode labels | Every time anyone opens the app |
| write_products | Writes a barcode or a unit cost back to a variant when you set one from a purchase order or the labels page | Only after you confirm a barcode or cost change |
| read_inventory | Reads on hand and incoming quantities per location for the reorder report, stocktakes and receiving | Every time anyone opens the app |
| write_inventory | Adjusts quantities when you receive against a purchase order or post a stocktake; activates an item at a location the first time | Only after you confirm a receipt or a stocktake |
| read_locations | Lists your locations so quantities and purchase orders are tied to the right one | On open, and when the location picker loads |
| read_inventory_transfers, write_inventory_transfers | Reads and creates Shopify transfers for moves between locations | Pro plan, multi-location stores only |
| read_inventory_shipments, write_inventory_shipments, write_inventory_shipments_received_items | Reads, creates and marks received the shipments that belong to those transfers | Pro plan, multi-location stores only |
| read_orders | Counts units sold per variant over the velocity window for the reorder report | When the reorder report is opened or refreshed |
Why an inventory app reads orders
The reorder report suggests how much to buy by comparing what you have against how fast it sells. The second half of that needs sales, and sales live in orders. So the report runs a search for orders created in the last N days, where N is your velocity window, excluding cancelled ones, and for each line item reads two things: which variant it was and the quantity that is still on the order after any refunds or removals. It adds those up per inventory item and divides by the days. That is the whole use of read_orders.
What it does not read is anything about the person who placed the order. No names, no email addresses, no shipping addresses, no payment details, no notes. The query asks for line item quantities and variant identifiers and nothing else, and nothing from an order is stored in the app: the totals are computed when the report is opened and discarded. Orders are what Shopify classifies as protected customer data, which means an app has to declare why it wants them and what fields it will touch before Shopify grants the scope. Restock Ops declares the minimum level, order data without any customer fields, and that is the level the panel should show.
There is one more thing worth knowing, because it tells you the dependency is real rather than habitual. If a store declines read_orders, or the protected data approval is still pending, the report does not break. It switches to a manual velocity: you type a units per day figure into each reorder rule and the report uses that instead. The post on products with no sales history describes that field, because a brand new product has the same problem for a different reason.
What the activity panel should look like
Shopify's recent activity summary is the most useful part of the new view because it shows use, not just grant. For Restock Ops the pattern is lopsided on purpose. The read scopes for products, inventory and locations light up whenever the app is open, since every page starts by reading current quantities; Shopify is the source of truth and the app does not keep its own copy to show you. The write scopes are quiet until someone presses a confirm button: receive these lines, post this stocktake, save this cost. Each of those writes is previewed to you first and then recorded in the app's own write log with the before and after values, which is the companion to Shopify's summary from the other side.
On a Starter plan with one location, the four transfer and shipment scopes should show no activity at all. Transfers are moves between locations and the app has no reason to touch them until a second location exists. We request them at install rather than later because Shopify asks the merchant to re-approve an app whenever it adds scopes, and asking a Pro customer to re-approve on the day they open a second warehouse is a worse experience than an idle permission; if you would rather the app did not hold them, tell us, since that is a design choice we are willing to revisit.
read_orders activity should coincide with reorder report visits and nothing else. Not with receiving, not with labels, not with stocktakes. If you see order reads at times nobody opened the report, that is the kind of mismatch the panel exists to surface.
Tokens, IP restrictions and sensitive data labels
The same view shows whether the app's access tokens expire. Restock Ops uses expiring offline tokens, the model Shopify has been moving all apps to, so a stolen token is useless within a day and the app refreshes its own access as it works. Shopify also shows whether the app's API calls are restricted to declared IP addresses, a requirement Shopify is making mandatory for public apps during November 2026; expect that line to read as enforced.
The sensitive data label is driven by the scopes an app holds, and read_orders puts Restock Ops into the category of apps that can access protected customer data even though it reads none of the customer fields. The label is a prompt to check, and the section above is the check. If you want the app without that label at all, decline read_orders and use manual velocities; everything else works unchanged.
A five minute review
- Open Settings > Apps and sales channels, click Restock Ops, and read the permissions list against the table above. Eleven scopes; nothing about customers, discounts, orders writing, themes or content.
- Check the activity summary. Reads of products and inventory whenever the app was open; writes only on days someone received, counted or edited a cost; order reads only on reorder report days; transfer and shipment scopes idle unless you are on Pro with more than one location.
- Confirm the token type reads as expiring and IP restrictions as enforced.
- Open the app's write log and spot check one Shopify write against the Shopify activity on the same day. The quantity, item and time should match.
- Repeat for every other app on the list. The post on what Shopify changed about purchase orders and transfers is a reminder that scope lists drift as platforms change, so the review is worth doing each time Shopify adds a line to this panel.
An app's permission list is a promise about intent; the activity panel is evidence about behaviour. Restock Ops was built so the two match, and now that merchants can see both, we would rather you checked than took our word for it.
FAQ
Why does Restock Ops need read_orders if it is an inventory app?
To calculate sales velocity for the reorder report. It reads line item quantities and variant identifiers from orders in the velocity window, sums them per item and divides by days. It reads no customer fields and stores nothing from orders. If you decline the scope, the report uses a manual units per day figure per rule instead.
Does Restock Ops store my order or customer data?
No. Order line quantities are read when the reorder report is opened, totalled in memory and discarded. The app stores its own records: suppliers, purchase orders, receipts, stocktakes, cost history and a write log of every change it made to Shopify quantities. None of those contain customer names, addresses or contact details.
Why are transfer and shipment permissions granted if I only have one location?
They are requested at install so a store that later opens a second location does not have to re-approve the app. With one location they are never used and the activity panel should show nothing for them. If you prefer the app not to hold them, let us know; it is a choice we are open to changing.
What should the recent activity summary show for Restock Ops?
Product, inventory and location reads whenever the app is open, because quantities are read live from Shopify rather than cached. Inventory and product writes only when someone confirms a receipt, a stocktake or a cost or barcode change. Order reads only when the reorder report runs. Anything outside that pattern is worth a support message.
Try it on your store. Restock Ops adds purchase orders with partial receiving, supplier notes, cost history, barcode labels, scanner stocktakes and a reorder report on top of Shopify inventory. From $19/month, 14-day free trial.