OAuth scopes Crossdock requests

When you install Crossdock, Shopify asks you to grant a set of permissions (called OAuth scopes). Crossdock follows a least-privilege model: at install it requests only read permissions, so you can explore catalog mapping and inventory drift without Crossdock making any changes to your store. Write permissions are requested separately — only when you click Enable sync for the first time.

Permissions granted at install (read-only)

These scopes are requested the moment you install Crossdock from the Shopify App Store. None of them allow Crossdock to change anything in your store.

read_products

Lets Crossdock read your existing Shopify products, variants, and options so it can discover which items from Square already have a matching Shopify product, find catalog drift, and run a dry-run import before any real changes are made.

read_inventory

Lets Crossdock read current inventory levels across your Shopify locations. Used alongside read_products to surface stock drift between Square and Shopify during the mapping and reconciliation steps.

read_orders

Lets Crossdock read Shopify orders so it can surface them in the order sync dashboard and, once order sync is active, match them to the corresponding Square orders. Order sync to Square activates only after Shopify approves Crossdock’s access to order data (Protected Customer Data), so no orders are pushed to Square until then. No orders are created or modified in Shopify by this scope alone.

read_customers

Lets Crossdock read Shopify customer records. When an order is pushed from Shopify to Square (on the Pro, Premium, and Scale plans), Crossdock reads the customer on the Shopify order so it can attach the correct customer to the Square order. Crossdock does not create or update Shopify customers.

read_locations

Lets Crossdock read your Shopify locations. Inventory updates are routed to the correct Shopify location when sync is enabled; this scope is the prerequisite for that routing.

read_merchant_managed_fulfillment_orders

Lets Crossdock read fulfillment order records for your Shopify orders. Used to surface fulfillment state in the order sync view and to support local pickup flows. No fulfillment actions are taken at install; the paired write scope is requested separately on Enable sync.

write_cart_transforms

The only write scope granted at install. Crossdock uses Shopify’s Cart Transform Function to correctly price priced modifiers (add-ons like “Extra shot” or “Large size”) in the cart. Registering and unregistering that function requires this scope. It does not grant any access to products, orders, or inventory.

Additional permissions when you enable sync (write access)

When you click Enable sync, Shopify will ask you to grant the following additional permissions. Crossdock will not make any writes to your store until you approve them.

write_products

Lets Crossdock create and update Shopify products, variants, and options to match your Square catalog. This is the core catalog sync scope — without it, Crossdock can only read your catalog, not update it. Read access for products is already covered by read_products granted at install.

write_inventory

Lets Crossdock update inventory levels at your Shopify locations when Square counts change. Two-way inventory sync (Square↔Shopify) also uses this scope to write back to Shopify when Square reports a stock movement.

write_merchant_managed_fulfillment_orders

Lets Crossdock write fulfillment state on Shopify orders. Used by order sync to mark Shopify orders as fulfilled when the corresponding Square order is completed. Order sync activates only after Shopify approves Crossdock’s access to order data (Protected Customer Data), so this capability is not active at launch.

write_publications

Lets Crossdock publish newly synced products to your Shopify Online Store sales channel. Without this, a product synced from Square exists in Shopify but is not visible to customers on your storefront.

write_shipping

Lets Crossdock turn on Shopify’s native in-store Local Pickup at checkout for your location when you mark products (or your whole store) as pickup-only. Without this, a pickup-only product removes the shipping requirement but does not surface the “Pick up” option with a prep-time estimate at checkout.

read_publications

Lets Crossdock look up your Online Store sales channel before publishing products to it. Shopify does not automatically grant read access when you grant write_publications — both scopes are needed together for Crossdock to correctly target your storefront.

Scopes Crossdock deliberately does not request

Crossdock does not request write_orders, write_customers, or write_locations at v1. Customer sync is one-way Shopify→Square (Crossdock reads a Shopify customer to attach to a Square order; it never writes back to Shopify). Crossdock never creates orders or modifies Shopify locations. Each new capability that needs a new scope goes through its own separate permission request — Crossdock will not expand its access without your explicit approval.