Permissions and data access

# Permissions and data access

Canonical: https://docs.flowrelay.app/setup/permissions-and-data-access/
Markdown: https://docs.flowrelay.app/setup/permissions-and-data-access.md

Use this page when a merchant, reviewer, buyer, or authorized agent needs to understand FlowRelay's default install path, optional Shopify scopes, and data boundary.

## Data rules
- Start with Generic when Shopify Flow only needs a custom external event and no native Shopify resource reference.
- Use Order, Customer, or Product only when Shopify Flow should receive a native reference from a sender-supplied resource ID.
- Keep payloads limited to lawful, necessary event data; use synthetic values for setup, docs, prompts, screenshots, and support examples.
- Do not ask FlowRelay support, agents, or docs examples to reconstruct private Shopify records from raw data.

## Default install vs optional grants
Generic endpoints can be installed and used without Shopify Order, Customer, or Product read scopes. When a merchant chooses an Order, Customer, or Product trigger, FlowRelay shows the matching optional scope as a Grant action in the embedded create/edit UI. Shopify prompts the merchant to approve that one scope, FlowRelay reloads after Shopify reports it was granted, and the endpoint can then be saved.


## Scope summary
FlowRelay requests read_orders, read_customers, or read_products only when a merchant chooses the matching native Order, Customer, or Product trigger. Shopify Flow needs that scope to receive the native reference. Resource IDs are supplied by inbound event payloads.


- Shopify scope: read_orders; Why it is requested: Lets Shopify Flow receive a native Order reference when the sender payload supplies an order ID or GID; What FlowRelay does not do: FlowRelay does not query, read, sync, enrich, browse, harvest, or export Shopify Orders for event enrichment.
- Shopify scope: read_customers; Why it is requested: Lets Shopify Flow receive a native Customer reference when the sender payload supplies a customer ID or GID; What FlowRelay does not do: FlowRelay does not query, read, sync, enrich, browse, harvest, or export Shopify Customers for event enrichment.
- Shopify scope: read_products; Why it is requested: Lets Shopify Flow receive a native Product reference when the sender payload supplies a product ID or GID; What FlowRelay does not do: FlowRelay does not query, read, sync, enrich, browse, harvest, or export Shopify Products for event enrichment.

## How the native reference path works
The normal path is: inbound sender sends a signed payload with a Shopify resource ID, FlowRelay maps that payload field, FlowRelay calls flowTriggerReceive with the normalized trigger payload, and Shopify Flow receives the native reference. FlowRelay reads the ID from the sender payload; it does not fetch the Order, Customer, or Product from Shopify during mapping.


## Shopify object access
FlowRelay does not query, read, sync, enrich, browse, harvest, or export Shopify Orders, Customers, or Products for native references.


## Secret and credential exposure
FlowRelay does not expose raw Shopify tokens, Shopify session material, endpoint secrets, full authentication headers, HMAC values, database URLs, or raw event bodies in public examples, default diagnostics, support summaries, or Agent Operations reads.


## Retention boundary
FlowRelay retention applies to FlowRelay event payloads, receipts, diagnostics, replay previews, and audit facts. It is not a Shopify Order, Customer, or Product sync window, because FlowRelay does not fetch those records for native references.


## Related
- [Event types and payloads](https://docs.flowrelay.app/setup/event-types-and-payloads.md)
- [Trigger variants and mapping](https://docs.flowrelay.app/setup/trigger-variants-and-event-mapping.md)
- [Retention](https://docs.flowrelay.app/operate/retention.md)
- [Share diagnostics](https://docs.flowrelay.app/recover/diagnostics.md)

## Safety Boundary
Do not share endpoint secrets, authentication headers, HMAC values, tokens, raw event bodies, customer records, Shopify sessions, store passwords, or database URLs in public examples.