Shop SDK lead capture now supports Rich Authorization Requests
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on October 28, 2026.
This Shopify update is categorized as Tools, New.
What changed
Lead capture now accepts an authorizationDetails attribute. The attribute takes a serialized JSON array that lists the fields your app needs and marks each one as required or optional. For example, this request requires a phone number and makes birthdate optional: const authorizationDetails = JSON.stringify([ { type: 'urn:shopify:shop_app:data-sharing:v1', datatypes: [ {name: 'phone_number', required: true}, {name: 'birthdate', required: false}, ], }, ]); You can request given name, family name, phone number, and birthdate with RAR. The existing OAuth scopes shop_app:user:profile and shop_app:user:phone let you request existing names and phone numbers, respectively, but don't prompt users to provide missing values. Before a user authorizes your app, Shop asks them for any requested fields that they haven't shared with your app.
Who is affected
This change applies to apps that use Shop SDK lead capture. To read data that you request with RAR, your app needs a client secret and a trusted server. As with existing lead capture, an authorized phone number returned by Shop can replace a different phone number on the store's customer record.
What action may be needed
To request data with RAR: Pass your serialized array as attributes.authorizationDetails when you create the lead capture instance. To also request the user's identifier and email, set attributes.scope to 'shop_app:oauth', as shown in the guide. In onComplete, send shopConsentToken to your server when the event includes one. The event doesn't include the requested data.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →