FOR SHOPIFY AGENCIES AND MERCHANTS

See which app scopes and webhooks changed — before you approve the next install.

Paste two customer-authorized app inventories. This page lists added or removed apps, scopes, webhook topics, and authorization-state changes. It does not connect to Shopify, request credentials, or say an app is safe. Everything runs here; nothing is uploaded.

Have a GraphQL appInstallations dump instead of inventory JSON? Capture → inventory, then compare here.

Before and after inventories

Showing the shipped fixture. Replace either side with your own export, then compare.

Drift record

—

Paste two exports, or load the fixture, to see a record.

What this checks

Shopify agencies reviewing an install often get a verbal “we added a reporting app.” The useful question is which granted scopes and webhook topics actually changed. This record answers that from two exports you already have — it does not pull live Shopify data and does not interpret Shopify policy.

Shopify distinguishes scopes an app declares from scopes a merchant granted. Put the granted values in the export. A future API adapter should keep that distinction; this page never infers a scope from an app’s name.

Export shape

Each inventory is JSON you control. Required fields: captured_at (ISO 8601), api_version, source, authorization_state, and apps (each with a unique id and string lists for scopes and webhooks). Incomplete exports are rejected. If a source cannot provide a field, leave the capture out rather than inventing a value. 

{
  "captured_at": "2026-08-24T10:00:00Z",
  "api_version": "2026-07",
  "source": "merchant-export",
  "authorization_state": "active",
  "apps": [
    { "id": "app-analytics", "scopes": ["read_analytics"], "webhooks": ["app/uninstalled"] }
  ]
}

Common questions

How do I compare Shopify app permissions before and after a change?

Export only app metadata (ids, granted scopes, webhook topics, authorization state, API version, source, and capture time) from a store you are authorized to administer. Paste the earlier export as Before and the later export as After. The page lists added and removed apps, scopes, and webhooks. It does not connect to Shopify or decide whether a change is allowed.

Does this tool connect to my Shopify store?

No. Comparison runs entirely in your browser from the two JSON exports you paste. There are no accounts, no Shopify API calls, and no upload.

What if the after export is older than the before export?

The record is marked inconclusive. A reversed capture order is never treated as an unchanged result.