Shopify custom / private app missing API scopes after update — reauth, access scopes, protected customer data, Admin API.

Several products can look like “the app broke after we updated it.” They do not share a settings panel. This page is only when Admin API (or related GraphQL) calls return 403 / ACCESS_DENIED / a missing_scope error after a custom app, private app, or public app scope change — so ERP, inventory, fulfillment, or CRM sync fails while the app may still open. A blank white iframe after install is admin app blank after install. HMAC / HTTPS webhook delivery failures are webhooks not delivering. GraphQL bulkOperationRunQuery hanging is bulk operations stuck. Theme app extension blocks missing in the editor are theme app extensions not appearing. This page is only: Shopify custom / private app missing API scopes after update.

Six ordinary reasons API calls die with 403 while the rest of the store looks fine: the app added scopes in Partners / TOML but the merchant never clicked Update / Reauthorize; the access token was issued before the new scopes; protected customer data fields need a separate approval; Admin API version expects scopes the old token never had; a legacy private app was replaced by a custom app without re-issuing credentials; or you are debugging blank admin / webhooks / bulk ops instead of the scope error body. Walk them in that order. You already pay for Shopify and usually the app. You do not need another “API SaaS” to read the 403 and finish reauth.

Capture one failing Admin API response body. Shopify usually names the missing scope (for example read_orders, write_products, read_customers). Screenshot the error, the app version / release notes that added the scope, and Settings → Apps → the app’s permissions list on the shop.

Then compare: (1) scopes declared in the app config (shopify.app.toml / Partners dashboard), (2) scopes shown on the shop after install, (3) whether Shopify is still showing an Update / Reauthorize banner for that app. If declared ≠ granted, the merchant must finish reauth — uninstall/reinstall is the blunt path; the Update button is the ordinary one. Honest fork: if the admin iframe is blank so you cannot open the app at all, leave this page and use admin app blank after install. If only webhook deliveries fail and Admin REST/GraphQL still works with a valid token, that is webhooks not delivering.

Protected customer data (PII fields on customers / orders) is not the same as having read_customers. Public apps need Shopify’s protected customer data access approval; custom apps follow the shop’s own access rules but still fail if the token never received the customer scopes. If the 403 mentions protected data or redacted fields, fix approval / scopes — do not keep retrying the same token.

Admin API version matters: a bump in the app’s API version can require scopes that were optional before, or deprecate a private app auth style. Confirm the X-Shopify-Access-Token (or session token exchange) is from the current install, not a leftover custom-app password from a retired private app. Custom apps created in Admin → Develop apps must have the needed Admin API access scopes enabled and installed on the shop; Partner OAuth apps need the merchant to approve the new scope set after release.

Checklist: (1) screenshot the 403 / missing_scope body, (2) open the app’s Update / Reauthorize prompt or Settings → Apps → [app] → review permissions, (3) approve the new access scopes as store owner / staff with app manage rights, (4) for custom apps, enable the missing Admin API scopes under Configuration → Admin API integration, then reinstall / re-install API access if the token was issued earlier, (5) rotate any leaked or stale tokens, (6) retry the exact Admin API call that failed and confirm 200 / expected GraphQL data.

Prove it: same endpoint, same resource ID, new access token from after reauth, no missing_scope in the body. If the vendor owns the OAuth client, send them the scope name from the error + whether Update was completed — that is enough for their eng without a full store rebuild. If bulk sync still hangs after scopes are fixed, switch to bulk operations stuck; scopes were never that page’s product.

Blank admin iframe after install is admin app blank after install. HMAC / HTTPS failures across many topics is webhooks not delivering. GraphQL bulkOperationRunQuery never completing is bulk operations stuck. Theme app blocks missing in Customize is theme app extensions not appearing. None of those fix a token that never received the new access scopes after an app update.

Finish 403 / missing_scope proof → reauth / custom-app scope enable → protected customer data / Admin API version → prove the same call returns data first. Only then open the related playbook that matches the remaining symptom.

Stay DIY if you can spend one afternoon on the list above: prove the missing scope name, finish Update / Reauthorize or enable custom-app Admin API scopes, clear protected customer data / Admin API version confusion, and stop treating blank admin / webhooks / bulk ops as the same bug. That is the whole playbook. No agency required. Short answers also live on the merchant FAQ. Related pages: admin blank app, webhooks not delivering, bulk operations stuck, theme app extensions.

Pay for help when the work is not the Partners scope panel — it is connecting the stack you already have so lead capture is not dying in DMs, scope / 403 exceptions land in a channel you already check, and the live store is one workflow instead of a spreadsheet plus a Slack bot you forgot. That is the Latch AI Ops install.

What $997 USD one-time buys: lead capture on the live store, ops alerts in a channel you already check, and a checkout-ready workflow. 72 hours after collaborator access, not after payment. One live Shopify store. Access plus a delivery thread. Store URL collected at checkout. Not a SaaS seat, not an app-dev retainer, not a conversion guarantee, not a brand or theme job.

Other shops’ public ranges, not testimonials: a checkout / ops install typically runs $500–$2,500. A full ops consulting block typically runs $2,000–$5,000. $997 is the cheap end of that work, sold as a 72-hour install of three systems — not as an earnings number or uptime claim.

What it does not buy: more orders, automatic Partner approval, an app license, or a case study. Latch AI Ops has not published customer proof because there are no customers yet. You are buying the install.

Checkout is on Whop. Operator is Nico. United States offer. You can revoke collaborator access after handoff. We do not take owner passwords.