What permissions Spectersync asks for on Shopify (and what it can't see)

Before you approve a Shopify app, you should know exactly what it can touch. Shopify’s install screen lists the scopes, but the plain-English summary it shows can read broader than the actual permission set — and on a store with real customer data, “I think it’s fine” isn’t good enough. This guide spells out the precise scopes Spectersync requests, what each one grants, and the surfaces of your store that remain invisible to it.

The scopes Spectersync requests

When you go through the connection flow in the browser, Shopify shows the install screen with two Admin API scopes:

read_content — read access to articles, blogs, comments on articles, and pages
write_content — write access to the same set: create, update, and delete articles, blogs, and pages

That’s it. Two scopes. Both scoped to the same content surface. Nothing else is requested.

These map directly to Shopify’s Article, Blog, and Page resources in the Admin API. The pair is what every legitimate blog-management app on Shopify uses, and they’re the minimum set required to do anything useful with articles.

What this actually grants

With these scopes Spectersync can:

List every blog on the store. Shopify lets a store have multiple blogs, each holding its own set of articles. Spectersync sees all of them.
Read every article in every blog. Title, body, author, handle (URL slug), tags, summary, featured image, publish status, publish date, and the SEO fields (page title and meta description).
Create new articles in any blog.
Update existing articles — the bread-and-butter operation that makes bulk SEO edits possible.
Delete articles — only when you explicitly approve the delete in the dry-run diff. Spectersync doesn’t trash content on its own.
Read and write pages (your About, Contact, Shipping pages — the static content surface that lives alongside the blog).

That’s the entire blast radius. Two verbs, three resources.

What it does NOT grant

This is the more important list. With read_content and write_content, Spectersync has no access to:

Orders. Not order details, not customer order history, not totals, not anything.
Customers. No names, emails, addresses, marketing consent, or saved payment methods.
Products. Spectersync can’t list products, read prices, change inventory, or update product descriptions. A CTA in an article can link to a product or collection — the URL is public — but Spectersync can’t reach into the product itself.
Inventory — quantities, locations, transfers, anything in the inventory surface.
Payouts and financials. No Shopify Payments balance, payout schedule, transactions, refunds, or chargebacks.
Themes and Liquid templates. No ability to read or modify theme files, sections, snippets, or template logic. The article you’re editing renders inside your theme’s article template — Spectersync just sends the article content; the theme renders it.
Metaobjects, metafields, navigation, redirects, the Files API, discount codes, gift cards, shipping zones, tax settings, staff accounts, locations, fulfilment services, or any app-data scopes.

If any of those operations were attempted, Shopify itself would reject the API call because the scope was never granted. That’s enforced at Shopify’s edge, not just by polite restraint.

Where the access token lives

After you approve the install, Shopify issues an access token tied to your store and the granted scopes. In the hosted webapp, that token is managed securely for your connection — it does not travel through your browser URL bar (the OAuth handoff is exchanged server-to-server), and it’s used only to read and write the content surface you authorised. Your content stays yours: the connection is read-and-write to your own Shopify store, and nothing here makes your store harder to leave.

How to revoke

There’s one canonical way to revoke Spectersync’s access to a Shopify store: uninstall the app in Shopify admin.

Log into your Shopify admin (your-store.myshopify.com/admin).
Go to Settings → Apps and sales channels.
Find Spectersync in the list of installed apps.
Click the · menu and choose Uninstall.

The moment you confirm, Shopify invalidates the access token. Any future API call against that store returns a 401. To also clear the connection in the workspace, remove the store from your connections.

This is also the standard rotation flow. There’s no separate “rotate token” button on Shopify’s side. If you suspect a token has been exposed, uninstall and then run the connection flow again — Shopify mints a fresh token at that point.

When the install screen looks different

Occasionally the Shopify install screen will list a scope you don’t recognise. That’s a red flag worth pausing on. Spectersync only ever requests read_content and write_content. If you see a scope that mentions orders, customers, products, or themes during a Spectersync install, do not approve it — back out, confirm you’re on the real connect flow, and re-run it. If the issue persists, the connection-failed troubleshooting covers what to check.

The plain-English summary above the scope list can occasionally read broader than the scope itself (“read and write your store’s content” is technically accurate but sounds vast). The authoritative line is always the scope names. If those say read_content, write_content, that’s the entire permission grant — articles, blogs, and pages, nothing more.

Running the engine on your own machine?

The scopes are identical in the desktop and open-source edition — same two scopes, same blast radius — but there the access token lives in your Mac’s Keychain rather than being managed for a hosted connection, and the OAuth dance completes against the local app. That guide walks the Keychain specifics and local revocation.