Scopes and staff permissions

Which Store Admin staff permission covers each Store API scope.

Every Store API scope is covered by a Store Admin staff permission. A team member can approve an app that requests a scope, and an App Bridge session they open can use it, only while they hold that permission. A scope with no staff permission can be approved and used only by the store owner. Store Admin tokens are created by the store owner and work with the authority of the person who created them: when that person is removed from the store, their permissions change, or store ownership is transferred, their tokens are revoked automatically.

Scope reference#

Scope	Covers	Staff permission	Store Admin tokens
`read_storefront`	Storefront settings and sales channels	`online_store.preferences:read`	Yes
`write_storefront`	Storefront settings and sales channels	`online_store.preferences:write`	Yes
`read_redirects`	URL redirects and 404 reports	`online_store.redirects:read`	Yes
`write_redirects`	URL redirects and 404 reports	`online_store.redirects:write`	Yes
`read_site_assets`	Storefront site assets	`online_store.site_assets:read`	Yes
`write_site_assets`	Storefront site assets	`online_store.site_assets:write`	Yes
`read_site_verification`	Site verification tags shown on storefront home pages	`online_store.site_verification:read`	Yes
`write_site_verification`	Site verification tags shown on storefront home pages	`online_store.site_verification:write`	Yes
`read_search`	Search settings and synonyms	`online_store.search:read`	Yes
`write_search`	Search settings and synonyms	`online_store.search:write`	Yes
`read_currencies`	Currency configuration and exchange rates	`settings.currencies:read`	Yes
`write_currencies`	Currency configuration and exchange rates	`settings.currencies:write`	Yes
`read_domains`	Custom domains, connection status and DNS records	`settings.domains:read`	Yes
`write_domains`	Custom domains, connection status and DNS records	`settings.domains:write`	Yes
`read_email_settings`	Sender addresses, sending domains and the customer reply-to address	`settings.email:read`	Yes
`write_email_settings`	Sender addresses, sending domains and the customer reply-to address	`settings.email:write`	Yes
`read_translations`	Store languages and content translations	`settings.languages:read`	Yes
`write_translations`	Store languages and content translations	`settings.languages:write`	Yes
`read_files`	Files and media uploads	`files:read`	Yes
`write_files`	Files and media uploads	`files:write`	Yes
`read_products`	Products, categories, attributes, tags, vendors, and brands	`products:read`	Yes
`write_products`	Products, categories, attributes, tags, vendors, and brands	`products:write`	Yes
`read_gift_cards`	Gift Card instruments, balances, delivery, and lifecycle	`gift_cards:read`	Yes
`write_gift_cards`	Gift Card instruments, balances, delivery, and lifecycle	`gift_cards:write`	Yes
`read_reviews`	Product reviews, moderation, and responses	`reviews:read`	Yes
`write_reviews`	Product reviews, moderation, and responses	`reviews:write`	Yes
`read_markets`	Market configuration and tax settings	`markets:read`	Yes
`write_markets`	Market configuration and tax settings	`markets:write`	Yes
`read_locations`	Store locations and inventory addresses	`locations:read`	Yes
`write_locations`	Store locations and inventory addresses	`locations:write`	Yes
`read_inventory`	Inventory groups, stock levels, and movements	`inventory:read`	Yes
`write_inventory`	Inventory groups, stock levels, and movements	`inventory:write`	Yes
`read_marketing`	Email and SMS templates and campaigns	`marketing:read`	Yes
`write_marketing`	Email and SMS templates and campaigns	`marketing:write`	Yes
`read_customers`	Customer profiles, addresses, tags, and groups	`customers:read`	Yes
`write_customers`	Customer profiles, addresses, tags, and groups	`customers:write`	Yes
`read_blog`	Blog posts, blog categories, and blog tags	`blog:read`	Yes
`write_blog`	Blog posts, blog categories, and blog tags	`blog:write`	Yes
`read_orders`	Orders and fulfillment orders	`orders:read`	Yes
`write_orders`	Orders and fulfillment orders	`orders:write`	Yes
`write_order_edits`	Item edits on placed orders, with the balance and refunds they cause	`orders:write`	No, apps only
`write_review_settings`	Review moderation, content filters, and submission rules	`reviews:write`	Yes
`read_carts`	Cart line property definitions and cart data	None (store owner only)	No, apps only
`write_carts`	Cart line property definitions and cart data	None (store owner only)	No, apps only
`read_pages`	Storefront pages and policies	`pages:read`	Yes
`write_pages`	Storefront pages and policies	`pages:write`	Yes
`read_menus`	Navigation menus and menu items	`menus:read`	Yes
`write_menus`	Navigation menus and menu items	`menus:write`	Yes
`read_reports`	Aggregate reports and shared report definitions	`analytics.reports:read`	Yes
`write_reports`	Aggregate reports and shared report definitions	`analytics.reports:write`	Yes
`read_payment_sessions`	Payment sessions assigned to this provider app	None (store owner only)	No, apps only
`write_payment_sessions`	Payment sessions assigned to this provider app	None (store owner only)	No, apps only
`write_provider_messages`	Outcomes of messages assigned to this provider app	None (store owner only)	No, apps only

A write scope includes the read scope it names in the scope catalog, and a :write staff permission includes the matching :read permission. A write-only scope listed with another resource's :write permission has no staff permission of its own and is never implied by that resource's write scope.

Managing Store Admin tokens#

Only the store owner can view, create, change the scopes of, rotate and revoke Store Admin tokens, in Store Admin or the mobile app under Settings > API Tokens. There is no Store API or MCP endpoint for managing tokens. A token automatically revoked because its creator's access changed is recorded in the store's activity log, and the store owner is notified (API tokens revoked). Every token change is recorded in the activity log with the person who made it. Requests with a revoked token return 401 STORE_ADMIN_TOKEN_RUNTIME_UNAUTHORIZED; see Authentication.