🔐 Module 3 · Scopes

401 vs 403 — and what scopes actually unlock

401 means credential trouble. 403 means the token is alive but the grant is missing or not merchant-approved. Releasing a version is not enough.

Get access See the outline

Public teaser. Scope packs, probe matrices, and re-approve rituals unlock after subscribe.

✨ Public teaser

What free visitors need to know

Module 3 is the practical Admin scope map for Grok store work — products, orders, themes, metafields, inventory — plus the merchant re-approve ritual after a Dev Dashboard release.

401 ≠ 403

401 = wrong/expired/revoked token (or shpss_… in the Admin slot). 403 = missing or unapproved grant.
Release ≠ approved

New app version with more scopes still needs merchant re-approve — often a fresh shpat_….
Partial success

Inventory can start working while list_locations / draft orders still 403 with “requires merchant approval.”

Least privilege

Grant what the workflow needs (catalog vs theme vs orders) — not the entire Admin surface.
Two-column truth

Tools listed ≠ scopes granted · Version released ≠ merchant approved.
Reauth can nuke tokens

After reinstall/reauth everything can flip to global 401 until you re-exchange.

🧪 Copyable teaser

Least-privilege starter pack (names only)

Scope names for a catalog smoke test — not a dump of every Admin grant.

Catalog starter scopes text

read_products
write_products
read_inventory
read_locations
# Add theme/order packs only when the workflow needs them.

🗺️ Outline

The map (titles public, examples locked)

★
Public

Error vocabulary first

401 credential · 403 grant/approval · don’t “add all scopes” as the first move.
Locked · Subscribers

Build the core scope packs Grok actually uses

Catalog · orders · themes · metafields · inventory/locations (+ adjacent grants).
Locked · Subscribers

Map workflows → minimum scopes

Lesson matrix: smoke test, products, theme assets, SEO, inventory, draft orders.
Locked · Subscribers

Dev Dashboard: declare, release, then stop

Then merchant re-approve · token refresh after reauth · probe scopes honestly.
Locked · Subscribers

Least privilege for multi-agent setups · Version drift hygiene

One documented grant set — decline “select all.”