Permissions and store data access

Workflow Suite asks for nothing up front. After installing, the app can read and change none of your store's data. You grant access per kind of data, when a workflow needs it, and you can take it back at any time.

A trigger only receives events, and a step only changes data, for what is granted.

Grant a permission

Open Permissions in the app menu.
Each card is one kind of data, such as Products, Orders, Customers, Inventory or Discounts, with a Read row and a Write row. A badge says Granted or Not granted.
Select Grant read or Grant write. Shopify shows its own dialog; confirm it there.

Grant all at the top asks for everything that is still missing, in one Shopify dialog.

Write access includes read access for the same data.

The editor tells you what is missing

You do not need to know the permissions by heart:

A trigger shows This trigger needs a permission.
A ready-made action shows This action needs a permission.
A Shopify mutation or query shows the permissions it needs in its docs box, granted or missing.
The workflow shows This workflow needs permissions with the full list, and cannot be turned on until they are granted.

Each of them has a button Open Permissions.

Which data for what

You want to	Grant
Start on product or collection events, tag products, change status or prices	Products
Start on order events, tag or cancel orders	Orders
Start on customer events, tag customers	Customers
Start on stock changes, set or adjust quantities	Inventory, and Locations for location ids
Create discount codes, start on discount events	Discounts
Work with draft orders, fulfillments, returns, companies	The card of the same name
Use metaobject triggers and their pickers	Metaobjects and Metaobject definitions
Use blog, post and page triggers	Content
Use storefront behaviour triggers	Storefront behaviour and Web pixel

The Permissions page describes every card.

Order, customer and draft order data needs Shopify's approval

Shopify treats orders, customers, draft orders, checkouts, fulfillments and companies as protected customer data. Granting the permission in the app is not enough: Shopify only delivers these events, and only answers these queries, for an app it has approved for that data. Name, email, phone and address are approved separately, and Shopify removes them from events when they are not.

What that means for you:

If a workflow with an order, customer, draft order or checkout trigger never starts, or a step fails with a message that the app is not approved to access a customer object, this is the reason. It is not a setting you can change in the app.
Product, collection, inventory, discount, metaobject and content workflows are not affected.
If you hit this, contact Support. We can tell you the current state of the approval for the fields you need.

Permissions this app cannot request

Some Shopify mutations need a permission that Shopify does not let this app ask for, or only hands out on application, for example subscription contracts, taxes and payment mandates. The step picker still lists those mutations, and the step's docs box says This app cannot request that permission. Such a step fails when it runs. See Every Shopify mutation and query.

Revoke a permission

On the Permissions page, select Revoke in the row.
Revoke access? lists what stops working. Confirm.

After that, triggers for that data receive no more events, steps that need it fail, and functions that rely on it are disabled until you grant it again.

How store data is accessed

Your store's access token is stored encrypted and never enters the code sandbox. Code and ready-made actions call Shopify through the app, with a short-lived token that is valid for one run and only for the permissions you granted.
Every call runs with exactly the permissions granted at that moment.
Over the Developer API, permissions can be read, not granted: granting needs you, in the Shopify admin. See Developer API and MCP.

Who can change permissions

Everyone with access to the app in your Shopify admin. Shopify's own staff permissions decide who that is.