Shopify Adds Mutation to Downgrade App Access Scopes

What Changed

Starting with Admin GraphQL API version 2027-01, Shopify is introducing a new mutation, appDowngradeAccessScopes, that allows apps using Shopify-managed installation to replace optional write scopes with their corresponding read scopes. This mutation only affects the calling app’s own installation and cannot be used to modify scopes for other apps.

To use this mutation, the scopes being downgraded must be declared in optional_scopes and must be write scopes that have a matching read scope equivalent. Required scopes declared in the app’s configuration cannot be downgraded using this method. Additionally, write scopes that are not currently granted to the app cannot be downgraded, since there is no active write permission to reduce.

Existing apps do not need to take any action as a result of this update. The change is additive and only applies when developers choose to implement the new mutation.

Why This Matters

This update gives app developers a programmatic way to reduce their app’s access footprint without requiring merchants to go through a full re-authorization flow. For apps built with Shopify-managed installation, this creates a cleaner path to align granted permissions with actual app functionality, particularly useful when an app’s feature set changes over time and previously required write access is no longer needed.

Practical Implications

Developers should review their optional_scopes configuration to identify write scopes that could be downgraded to read-only access. This is particularly relevant for apps undergoing feature deprecation or those tightening permission models for compliance or security reviews. Note that required scopes still need to be managed through standard app configuration updates, not this mutation.

Read the full announcement →