Should Shopify merchants give every installed app permission to edit their theme?
An app asks for access while you are trying to get work done. You need reviews, subscriptions, search, email capture, or a new sales channel. The permission screen is one more thing between you and the job.
It is tempting to approve everything.
But an app that can edit your theme can change the files that run your storefront. That includes templates, assets, and code a customer sees while browsing, adding to cart, or checking out.
So the short answer is no: do not give every installed app permission to edit your theme.
What theme-write access actually means
The Shopify permission to look for is `write_themes`.
It lets an app modify theme templates and assets. The related `read_themes` permission lets an app read theme information without changing it. You can see these as part of an app's access request or installed-app details.
That does not mean every app requesting `write_themes` is unsafe. Some jobs really do need changes in a theme.
The question is simpler than that: does this app need to change the code that runs your storefront to do its job?
If the answer is unclear, pause before approving it.
Shopify says most apps that integrate with a theme should use theme app extensions rather than direct access to theme files. For apps distributed publicly, direct theme changes need both the `write_themes` scope and a Shopify-approved exemption for that specific use case. Shopify can revoke that exemption. Shopify's access-scope guidance is clear that direct theme access is not the normal route.
Prefer blocks and embeds over code changes
Theme app extensions give apps two main ways to appear in your store:
- App blocks, which you place in a section or template through the theme editor
- App embed blocks, which you turn on in the theme editor when an app needs to load across the store
Neither option requires the app to edit your theme code.
That matters when you change themes, update a theme, remove an app, or ask someone else to work on the store. The app's storefront piece is visible in the theme editor instead of buried in a Liquid file or a script include.
Shopify says theme app extensions reduce the risk of breaking changes and reduce support work caused by theme changes. Its App Store requirements also say apps that modify a merchant's theme must use theme app extensions, rather than having the app or merchant make direct code changes. See Shopify's theme app extension documentation and App Store requirements.
You can check this yourself in under a minute:
1. In Shopify admin, open Online Store → Themes. 2. Open Customize on your live theme. 3. Look for App embeds in the left sidebar. 4. Open a relevant product, collection, or page template and look for installed Apps blocks.
If an app has a block or embed there, you can usually see whether it is active without opening code.
That is a better starting point than assuming an app needs broad theme access.
Why direct edits create work later
Theme code is not just decoration. It is part of the store's operating system.
A direct edit can be small: one script tag, one snippet, one altered template. But small changes can become hard to trace after a redesign, an app uninstall, or a developer handoff.
Shopify warns that direct theme edits can take a theme off its upgrade path. It also says that if an app leaves code behind after uninstall, the app must provide instructions for removing it.
That last part is worth taking seriously. “Instructions available” is not the same as “nothing was left behind.”
Before you uninstall an older app, write down:
- Which theme was live when you installed it
- Whether it added an app embed or app block
- Any code-install steps you completed yourself
- The app's removal instructions
Then check the live store after uninstalling. Open a product page, collection page, cart, and homepage. Test them on a phone too.
If you are comfortable checking code, open Online Store → Themes → … → Edit code and search for the app's name, domain, or a distinctive snippet name. Do this on a duplicate first if you plan to remove anything manually.
Ask for the smallest permission that does the job
We use this rule in our own work: ask for less, then verify the result.
When we shipped our public store audit, we chose to read only public URLs. It checks things a visitor can reach: `robots.txt`, the catalogue endpoint, product markup, and policy pages. It does not need an install or a login for that basic read.
We made a similar choice with our own theme-related work. We deliberately ship without theme-write permission. That means a merchant may need to paste a template into their theme when a file must live there. It is less convenient than writing the file automatically.
But fewer permissions means less to trust.
There is a trade-off. After a merchant pastes the template, we read the live URL rather than assuming it worked. The store, not our setup screen, is the final check.
You can apply the same thinking to any app request. Ask:
- Could this work with an app block or embed?
- Could the app read data without changing theme files?
- Could the permission be requested only when I turn on that feature?
- Can I confirm the change on the live storefront?
Shopify supports optional scopes. An app can ask for extra access after installation, and you can grant or decline that request. Shopify describes this as a way to avoid asking every merchant for the same data access from the start. Optional scopes are a sensible pattern: broad access should follow a real need, not arrive by default.
Review installed app access now
You do not need to remember what you approved months ago.
In Shopify admin, go to Settings → Apps. Select an installed app to review its access areas, its view and edit permissions, and recent activity. Shopify also shows whether a permission was unused during the previous 30 days.
This is not proof that an unused permission is unnecessary. Some features run monthly or only when you trigger them.
Still, it gives you a useful list for questions. If an app has theme-write access and you cannot explain why, ask its support team a direct question:
Which storefront feature needs `write_themes`, and can it use a theme app extension instead?
Keep the answer with your store notes. That sounds ordinary because it is. Good store maintenance is mostly ordinary records kept before you need them.
Give people access without sharing the whole store
Sometimes a developer or agency really does need to work in your theme. That is different from letting every installed app change it.
For that case, Shopify points merchants to the Theme Access app. It can create theme-only passwords without creating staff accounts. This keeps the access focused on theme work instead of giving a contractor broader store access than they need. Shopify explains the option in its theme code help documentation.
Before anyone edits code, duplicate your live theme. Ask them to work in the copy. Then review the changed storefront pages before publishing.
This gives you a rollback point if a change affects navigation, product pages, cart behavior, or mobile layout.
A simple rule for future installs
Do not treat a permission request as a routine checkbox.
Give theme-write access when the app has a specific job that cannot use a theme app extension, and when you understand what it will change. Prefer an app block, app embed, read-only access, or an optional permission when those options fit.
Then check the live storefront after the work is done.
Your next step is simple: open Settings → Apps and review one installed app with theme-write access. If you cannot name the feature that needs it, ask before leaving it in place.