Google Apps Script Permissions: What Every Ecommerce Owner Must Know Before Deploying

When you click “Authorize” on a Google Apps Script, you are deciding which parts of your Google account the script can touch. Choosing the right permissions (called scopes) is the first step to a secure, reliable ecommerce workflow. Below is a step‑by‑step guide that shows you exactly what to check, how to set scopes, and what to do if a permission error appears.

Understanding Apps Script Permission Scopes

Scopes are short strings that tell Google which APIs a script may call. They are defined in the appsscript.json manifest or added automatically when you use a service for the first time.

Common scopes for ecommerce automation

• https://www.googleapis.com/auth/spreadsheets – read/write any spreadsheet you own or have edit access to.
• https://www.googleapis.com/auth/drive.file – create or modify files in Drive, useful for saving CSV exports.
• https://www.googleapis.com/auth/gmail.send – send order confirmation or alert emails.
• https://www.googleapis.com/auth/urlfetch – call external APIs such as Shopify, Amazon MWS, or payment gateways.
• https://www.googleapis.com/auth/script.external_request – required when a web‑app makes HTTP requests to third‑party services.

Only request the scopes you truly need. Over‑granting can confuse reviewers, raise security concerns, and cause unnecessary re‑authorization when you add new features.

How to Set and Review Permissions Before Deployment

Follow this ordered plan to get your script ready for production.

1. Create the script project. Open a Google Sheet, choose Extensions → Apps Script, and give the project a clear name (e.g., “Shopify‑Order‑Sync”).
2. Write the core code. Use the services you need. The first time you call SpreadsheetApp or UrlFetchApp, Apps Script will automatically add the corresponding scopes to the manifest.
3. Manually edit the manifest (optional). Open appsscript.json via the left‑hand “Project Settings” button and list only the scopes you want. Example: { "timeZone": "Asia/Karachi", "exceptionLogging": "STACKDRIVER", "oauthScopes": [ "https://www.googleapis.com/auth/spreadsheets", "https://www.googleapis.com/auth/urlfetch", "https://www.googleapis.com/auth/script.external_request" ] }
4. Test the script in the editor. Run a function manually. The first run triggers an authorization dialog that lists the scopes you are requesting.
5. Deploy as a web app (or add‑on). Choose Deploy → New deployment → Web app. Set “Execute the app as” to Me (owner) if the script needs to access your Sheets, and “Who has access” to Anyone or Anyone with the link depending on your use case.
6. Review the deployment permissions. After deployment, open the Google Account Permissions page and verify that the new entry shows only the scopes you listed.
7. Record the OAuth client ID. If you plan to embed the web app in an external site, note the client ID for future API‑key management.

If any step fails, the error message usually points to a missing scope. Add it to the manifest, save, and re‑run the test.

Managing Permissions After Deployment

Permissions are not static. When you add a new feature—say, sending Slack notifications—you’ll need an extra scope (https://www.googleapis.com/auth/webhooks is not a real scope, but you would need https://www.googleapis.com/auth/script.external_request again). Here’s how to handle changes safely.

• Version your deployment. Each time you modify scopes, create a new version in the Deploy dialog. Users of the old version keep the old permissions until you switch them.
• Force re‑authorization. After publishing a new version, open the web‑app URL in an incognito window. The auth dialog will appear again, showing the updated scopes.
• Revoke unnecessary access. Go to the Permissions page, locate the entry, and click “Remove Access”. The next run will ask for fresh consent.
• Monitor logs. In the Apps Script editor, open View → Executions to see which scopes were used for each run. Errors like “Missing required scopes” appear here.

Realistic Example: Syncing Shopify Orders to Google Sheets

Imagine you run a small Shopify store in Saudi Arabia and want a daily sheet that lists every new order. The script runs as a time‑based trigger, pulls orders via Shopify’s REST API, and writes them to a sheet.

Assumptions

• You have a private app in Shopify with read_orders permission and an API key/secret.
• The target Google Sheet already has a header row (Order ID, Date, Customer, Total).
• You only need spreadsheets, urlfetch, and script.trigger scopes.

Minimal code snippet

function syncShopifyOrders() { const SHEET_ID = 'YOUR_SHEET_ID'; const API_URL = 'https://yourstore.myshopify.com/admin/api/2023-07/orders.json?status=any&created_at_min=' + getYesterdayISO(); const HEADERS = { 'Authorization': 'Basic ' + Utilities.base64Encode('API_KEY:API_PASSWORD') }; const response = UrlFetchApp.fetch(API_URL, {headers: HEADERS}); const orders = JSON.parse(response.getContentText()).orders; const sheet = SpreadsheetApp.openById(SHEET_ID).getSheetByName('Orders'); orders.forEach(order => { sheet.appendRow([order.id, order.created_at, order.customer.email, order.total_price]); }); } function getYesterdayISO() { const yesterday = new Date(); yesterday.setDate(yesterday.getDate() - 1); return yesterday.toISOString(); }

After saving the script, create a trigger: Edit → Current project's triggers → Add Trigger → syncShopifyOrders → Time‑driven → Day timer → 02:00 AM. The first run will prompt for the three scopes listed above. Once authorized, the sheet updates automatically each morning.

Common Mistakes & How to Fix Them

• Missing urlfetch scope. Error: “Exception: You do not have permission to call UrlFetchApp.” Fix: add https://www.googleapis.com/auth/urlfetch to the manifest and re‑authorize.
• Over‑granting drive scope. Gives the script full Drive access, which is unnecessary for a simple sheet. Remove https://www.googleapis.com/auth/drive and keep drive.file instead.
• Trigger not firing after a code change. Changing a function name or adding a new scope invalidates the old trigger. Delete the old trigger and create a fresh one.
• Authorization dialog not appearing. This happens when the script runs under the “owner” account in a web‑app deployment. Open the web‑app URL in a private browser window to force the consent screen.

Pre‑Launch Checklist

1. Define the exact data you need (Sheets, Drive files, Gmail, external API).
2. List required scopes and add them to appsscript.json manually.
3. Run each function in the editor to surface missing scopes early.
4. Deploy as a web app or add‑on with the correct “Execute as” setting.
5. Test the deployment URL in an incognito window; confirm the consent screen matches your scope list.
6. Set up triggers (time‑based, on‑edit, etc.) and verify they appear in the Triggers dashboard.
7. Check the Google Account Permissions page for stray entries; revoke anything unnecessary.
8. Document the API keys, sheet IDs, and any required service accounts in a secure location.

Conclusion

Google Apps Script permissions are the gatekeeper of your ecommerce automation. By explicitly defining scopes, testing early, and reviewing the consent screen before you go live, you avoid unexpected authorization errors and keep your data safe. If a scope‑related problem persists after following the steps above, or if you need a custom workflow that mixes Shopify, Amazon KSA FBA, and Google Sheets, reach out for professional help.

View the Apps Script ecommerce source‑code package. Need deployment or custom workflow support? Contact us today.