Permissions Exactly what each connector can read
The permissions each live connector asks for, what we read with each one and the screen it feeds, and what we deliberately leave out. Where a platform offers a read-only version, we use it. Where it doesn’t, we still only read.
Sh
Shopify
Granted on Shopify’s install screen, which lists these access scopes before you approve.
| Permission | What we read with it | Access |
read_products | Your products, variants, SKUs and prices, for the product catalogue, product costs and sales by product. | Read-only |
read_orders | Orders, their lines and refunds, for sales by channel and product, profit, and the sales map (from the ship-to state, country and an approximate location within a few km; no postal code or city is kept). | Read-only |
read_all_orders | Your whole order history, not just Shopify’s default 60 days, so year-over-year figures and the sales forecast are right. | Read-only |
read_inventory | Stock per location for the stock screen, and each variant’s unit cost for product costs and profit by product. | Read-only |
read_shopify_payments_payouts | The Shopify Payments fee on each charge, and your payouts, for fees and payouts in Profit. | Read-only |
read_locations | The names of your locations on the stock screen. | Read-only |
read_returns | What happened to each returned unit (restocked, not restocked or missing), so a restocked unit comes off cost of goods in Profit. Never the return reason or the customer’s note. | Read-only |
Az
Amazon Seller Central
Granted on Amazon’s authorization page in Seller Central. Amazon gives access by role; ChannelHawk’s app holds these four.
| Permission | What we read with it | Access |
Product Listing | Your listings report, for the product catalogue and seller-fulfilled stock. | No read-only option |
Inventory and Order Tracking | Your orders report, for sales, profit and the sales map (ship-to state, country and an approximate location within a few km; no postal code or city is kept). | No read-only option |
Finance and Accounting | Refunds and every fee per order, for profit and fees, and settlement reports, for payouts. | No read-only option |
Amazon Fulfillment | FBA stock (fulfillable, inbound and reserved), FBA customer returns, and monthly and long-term storage fees. | No read-only option |
Amazon’s roles have no read-only versions. We only download reports and read; we never change a listing, a price or an order.
Qb
QuickBooks Online
Granted on Intuit’s sign-in and consent screen, for the company you choose.
| Permission | What we read with it | Access |
com.intuit.quickbooks.accounting | Your company name and home currency; the chart of accounts and its balances; items and their purchase cost; invoices and sales receipts; expenses, bills, journal entries and deposits; purchase orders; and the monthly profit and loss. These feed cash and books, the cash forecast, product costs and supplier lead times. | No read-only option |
Intuit offers no read-only accounting scope. We only read; we never post to or edit your books.
Ga
Google Ads
Granted on Google’s consent screen. Each Google connection carries only its own scope: connecting Google Analytics doesn’t extend this one.
| Permission | What we read with it | Access |
openid | Confirms which Google account you signed in with. | Read-only |
email | That account’s email address, which names the connection on Settings → Integrations. | Read-only |
https://www.googleapis.com/auth/adwords | Spend, impressions, clicks, conversions and conversion value per campaign, ad group and keyword, per day, and search impression share. These feed Ad performance, the Advisor and Recommendations. | No read-only option |
Google offers no read-only Google Ads scope. We only read; we never create, change or pause a campaign, or change a budget.
Me
Meta Ads
Granted on Facebook’s login dialog. Meta adds your public profile (your name and id) to every login; we use it only to name the connection.
| Permission | What we read with it | Access |
ads_read | The ad accounts you have a role on, to choose from, then daily spend, impressions, clicks, reach, purchases and purchase value per campaign, ad set and ad. These feed Ad performance, the Advisor and Recommendations. | Read-only |
Pi
Pinterest Ads
Granted on Pinterest’s consent page.
| Permission | What we read with it | Access |
ads:read | Your ad accounts, to choose from, then daily spend, paid impressions, outbound clicks, engagements, checkouts and checkout value per ad account and campaign, for Ad performance. | Read-only |
user_accounts:read | The connected Pinterest account’s name, which names the connection on Settings → Integrations. | Read-only |
G4
Google Analytics 4
Granted on Google’s consent screen. Each Google connection carries only its own scope: connecting Google Ads doesn’t extend this one.
| Permission | What we read with it | Access |
openid | Confirms which Google account you signed in with. | Read-only |
email | That account’s email address, which names the connection on Settings → Integrations. | Read-only |
https://www.googleapis.com/auth/analytics.readonly | The properties you can choose from, then sessions, key events and purchase revenue by source and medium, and by landing page, per day. These feed Google Analytics’ row on Ad performance and the Landing pages table. | Read-only |
Kl
Klaviyo
A private API key you create in Klaviyo (Settings → Account → API keys) and paste into ChannelHawk, with read access to these five and nothing else.
| Permission | What we read with it | Access |
accounts:read | Your account’s name, which names the connection on Settings → Integrations. | Read-only |
campaigns:read | Each campaign’s name, send date, recipients, opens, clicks, conversions and conversion value, for Ad performance. | Read-only |
flows:read | The same for each flow, per day. | Read-only |
lists:read | Each list’s name and size, once a day, for email list growth. Only the count: never the profiles in a list. | Read-only |
metrics:read | Finds your Placed Order metric, which conversions are measured against. | Read-only |
