Permissions and data access
Workflow Trigger Extensions requests no data access on install. Every resource it can read is opt-in and granted individually, so the app can only see what your workflows actually need.
Granting a permission
- Open Permissions in the app navigation.
- Find the card for the data you need.
- Click Grant, then confirm in Shopify's dialog.
Each card names the triggers it unlocks, so you can work backwards from the trigger you want. Revoking works the same way and takes effect immediately.
The permissions
| Permission | Unlocks |
|---|---|
| Product, Variant & Collection Data Access | Product, variant, and collection triggers, plus their metafields |
| Customer Data Access | Customer triggers, tags, note, state, marketing consent, and customer metafields |
| Order Data Access | Order triggers, line items, fulfillment, financial status, and order metafields |
| Draft Order Data Access | Draft order triggers for B2B and wholesale workflows |
| Company & Company Location Data Access (B2B) | Company, company location, and company contact triggers |
| Discount Data Access | The full discount lifecycle including expiry |
| Inventory Data Access | Per-location stock and variant cost triggers |
| Locations Data Access | Location lifecycle triggers |
| Markets Data Access | Market lifecycle triggers |
| Publications Data Access | Product published to and unpublished from a sales channel |
| Blog, Blog Post & Page Data Access | Storefront content triggers (polling) |
| Metaobject Data Access | Metaobject entry triggers |
Protected customer data
A small number of triggers read personal data: customer name, email, phone and address; order shipping address; draft order email and addresses. These are opt-in on top of the permission and marked (opt-in, protected data) on the Permissions page.
When enabled:
- the app reads only those specific fields,
- the values are encrypted at rest, and
- they are decrypted only at the moment the Flow trigger fires, and forwarded only to your own workflow.
Order history window
Order snapshots are seeded from the last 60 days by default, which is the window Shopify grants by default. If your workflows need to detect changes on older orders, request the extended order history scope from the Permissions page and widen the window.
If you revoke a permission
Triggers that depend on it stop firing immediately. Your settings and workflow configuration are kept, so re-granting the permission restores them. Change detection resumes from a fresh baseline rather than replaying what happened while access was revoked.