---
title: "App permissions: optional access to order and customer metafields"
description: "Which Shopify permissions Workflow Transactional Email asks for, why nothing is granted at install, what each optional permission (orders, customers, files, discounts) does, and how to withdraw it."
canonical: "https://docs.workflow-transactional-email.app/permissions"
---

# Permissions: what the app can read from your store

> [!NOTE]
> **Coming soon**
> The Permissions page and the optional permissions described here ship with version 1.17. Until then the app has no access to your store data at all.

This app is built so that it needs as little of your store data as possible. This page says exactly what it can read or do, when, and how you take that back.

## Nothing at install

When you install the app, Shopify asks you for **no access scopes**. The app cannot read your products, orders, customers or anything else in your store. Customer data reaches an email only because *you* pass it in from Shopify Flow, through the step's fields and the **Variables (JSON)** field. Flow reads your store data; you decide what to hand over.

That has not changed. Everything below is optional and off until you switch it on.

## The optional permissions

Two features need more. Attaching the file that a **metafield** of the order or customer holds, for example the invoice PDF another app saved on the order (see [Attach a file from an order or customer metafield](https://docs.workflow-transactional-email.app/attachments-from-metafields.md)): Shopify only lets an app read a metafield with the permission for the resource it sits on, and only lets it turn the file reference into the file with the files permission. And the **discount code block** set to create a unique code for every email (see [Content blocks: product, discount, countdown, tracking and more](https://docs.workflow-transactional-email.app/content-blocks.md)): creating a code discount in your store needs the discounts permission.

| Permission | Shopify scope | What the app does with it |
| --- | --- | --- |
| **Orders** | `read_orders` | Reads the one metafield named in your layout, on the one order the Flow step is about. Orders of the last 60 days. |
| **Customers** | `read_customers` | The same, on the customer the Flow step is about. |
| **Files** | `read_files` | Resolves the file a metafield points to: its download link, nothing else in your Files. |
| **Discounts** | `write_discounts` | Creates a single-use code discount when an email with a "create a unique code" block is sent, with the value, validity and minimum you set in the block. It never reads, changes or deletes other discounts. |

The app never reads or creates anything on its own. It acts only while it sends an email whose layout asks for it: that metafield on that resource and the file it points to, or that one discount code. It does not list your orders or customers, does not read names, addresses, emails or line items, and stores none of what it reads: the file is downloaded for that send and attached; the created code is kept with the send in History so a resend can show it.

## How you grant one

You never grant a permission on a settings page by accident. The first time you pick an order or customer metafield in the attachment picker, or switch a discount block to creating codes, the app explains which permission it needs and offers **Grant access**. Shopify then shows its own consent dialog, listing the scopes; nothing is granted until you confirm it there.

Granting a permission is per store and needs a staff account that may change app permissions. If your account cannot, Shopify refuses and the app tells you to ask the store owner.

## How you take it back

Open **Permissions** in the app's navigation. Every permission is listed with its scope, whether it is granted, and a **Revoke** button. Revoking takes effect at once.

After a revoke, every email that needs the permission fails at send time, recorded in History with the reason, until it is granted again. Emails that do not need it are not affected. Codes created before a revoke stay in your store; delete them under **Discounts** if you want them gone.

> [!WARNING]
> **Protected customer data**
> Shopify classes order and customer access as protected customer data, whatever an app reads with it. We declared the minimum, level 1, with no name, address, email or phone fields, and only for the metafield attachment feature. The declaration and the review are Shopify's; the permissions in the table above are what the app is allowed to ask you for. Discounts are not customer data.

## What this means for your privacy documentation

If you keep a record of processing or a list of processors, the app's role does not change: it acts as your processor, on your instructions given in Flow. With a permission granted, the categories of data it may see extend to the file in the metafield you chose. Our [Data, privacy and security](https://docs.workflow-transactional-email.app/data-privacy-and-security.md) page and the DPA on our website describe this; the DPA is available on request from the Help page.

## Frequently asked

**Does the app read my orders once I grant Orders?** No. It reads one metafield on one order while it sends an email whose layout attaches a file from that metafield. There is no sync, no list and no background reading.

**Can I grant Orders but not Files?** You can, but the file cannot be attached then: a metafield stores only a reference, and reading the file behind it needs the files permission. The picker asks for both together, and the Permissions page shows each on its own.

**Why does the consent dialog say "View customer data" and "device and activity data"?** That is Shopify's standard wording for the orders scope, listed in every app's dialog. The app reads none of those fields.

**What happens to the file after sending?** It is attached to the email and discarded. It is not copied into the app's storage and does not count against your storage allowance.

**What does a created discount code look like in my store?** A code discount named "Email code PREFIX-XXXXXX", one use, with the settings of the block. You can find, edit or delete it under Discounts like any other.

## Related

- [Attach a file from an order or customer metafield](https://docs.workflow-transactional-email.app/attachments-from-metafields.md) - the feature that needs the order, customer and files permissions.
- [Content blocks: product, discount, countdown, tracking and more](https://docs.workflow-transactional-email.app/content-blocks.md) - the discount block that needs the discounts permission.
- [Data, privacy and security](https://docs.workflow-transactional-email.app/data-privacy-and-security.md) - what the app stores, where and how long.
- [History and troubleshooting](https://docs.workflow-transactional-email.app/history-and-troubleshooting.md) - reading a failed send.