Permissions and data access

Workflow Trigger Extensions requests no data access on install. Every resource it can read is opt-in and granted individually, so the app can only see what your workflows actually need.

Granting a permission

Open Permissions in the app navigation.
Find the card for the data you need.
Click Grant, then confirm in Shopify's dialog.

Each card names the triggers it unlocks, so you can work backwards from the trigger you want. Revoking works the same way and takes effect immediately. Switching on a trigger from the Triggers page asks for the permission it needs right there, so you can also grant in passing.

The permissions

Permission	Unlocks
Product, Variant & Collection Data Access	Product, variant, and collection triggers, plus their metafields
Customer Data Access	Customer triggers, tags, note, state, marketing consent, and customer metafields
Order Data Access	Order triggers, line items, fulfillment, financial status, and order metafields
Draft Order Data Access	Draft order triggers for B2B and wholesale workflows
Company & Company Location Data Access (B2B)	Company, company location, and company contact triggers
Discount Data Access	The full discount lifecycle including expiry
Inventory Data Access	Per-location stock and variant cost triggers
Locations Data Access	Location lifecycle triggers
Markets Data Access	Market lifecycle triggers
Publications Data Access	Product published to and unpublished from a sales channel
Blog, Blog Post & Page Data Access	Online store content triggers: blogs, blog posts and pages (polling)
Metaobject Data Access	Metaobject entry triggers
Storefront Behaviour Access	The storefront and checkout triggers fed by the app's web pixel: product, collection and cart views, cart changes, searches, checkout errors, rejected discount codes, signed-in and B2B visits, and Custom Storefront Triggers

Protected customer data

A small number of triggers read personal data: customer name, email, phone and address; order shipping address; draft order email and addresses. These are opt-in on top of the permission and marked (opt-in, protected data) on the Permissions page.

When enabled:

the app reads only those specific fields,
the values are encrypted at rest, and
they are decrypted only at the moment the Flow trigger fires, and forwarded only to your own workflow.

Some triggers need two permissions.

Order Shipping Address Changed reads the address through the order's customer record, so it needs Customer Data Access in addition to Order Data Access. With only Order access the webhook still arrives but the address lookup is denied, and the trigger silently never fires.
A trigger that hands Shopify Flow a product, customer or order also needs that record's permission. Flow refuses an event that points at something the app is not allowed to read, and the event shows as failed in Event History:
- Product, Variant & Collection Data Access as well: Inventory Level Changed at Location, Out of Stock at Location, Back in Stock at Location, Product Variant Cost Changed, Product Published to Channel, Product Unpublished from Channel, Storefront Product Viewed, Storefront Product Added to Cart, Storefront Product Removed from Cart, Storefront Search and Out-of-Stock Variant Viewed.
- Customer Data Access as well: Signed-In Customer Visited, Company Contact Updated, Customer Removed from Company and First-Time Customer Order.

The Complete trigger reference lists every permission each trigger needs.

Storefront Behaviour Access

This permission is different from the others in three ways, and each is worth knowing before you grant it.

It reads shopper behaviour, not store records. Behind it is Shopify's read_customer_events scope, granted together with write_pixels so the app can install a web pixel on your storefront. The permission alone collects nothing. The pixel is installed when the first storefront trigger is switched on, and it sends nothing while no storefront trigger is on.

Shopify's consent dialog is broader than what the app does. When you grant it, Shopify shows a warning about sensitive data, device and activity information. That text is Shopify's, is identical for every app requesting the scope, and describes the widest thing the scope could allow. What this app actually sends to its own servers is commerce context: product, variant, collection, cart and checkout ids and titles, quantities and prices, the search term, the text of a checkout error, a rejected discount code, the customer id when a shopper is signed in and the company and location id and name for a signed-in B2B buyer, plus the IP address that is part of any web request. It never sends shopper names, email addresses, phone numbers or postal addresses, and it never forwards other checkout fields such as gift card codes.

Your shoppers' consent decides whether anything is collected. The pixel honours your store's customer privacy settings. A shopper who has not given analytics consent is dropped in the browser, and the event never reaches us, costs nothing and starts no workflow. You remain responsible, as the store owner, for obtaining that consent from your visitors.

Storefront events are stored with the rest of your Event History and deleted on the same schedule. See Storefront triggers for the triggers themselves.

Order history window

Order snapshots are seeded from the last 60 days by default, which is the window Shopify grants by default. If your workflows need to detect changes on older orders, request the extended order history scope from the Permissions page and widen the window.

If you revoke a permission

Triggers that depend on it stop firing immediately. Your settings and workflow configuration are kept, so re-granting the permission restores them. Change detection resumes from a fresh baseline rather than replaying what happened while access was revoked.