When publishing Shopify or Bigcommerce Apps, I had to specify the read/write permissions I wanted for my app (eg. read products, read/write orders...). I am now developing a Magento Extension and wondering where and how I would specify my desired permissions. I took a look in the Connect Marketplace and when downloading extensions, there doesn't seem to be a step, where you agree to any permissions. Am I missing something?

1 Answer 1


There are not permissions at "extension" level in magento, regardless the installation source (connect, manual, etc).

You could set some ACL at backend level for menus and actions (view/save/edit)

And you can set some permissions for the SOAP an REST APIs throw configuration files.

I don't know exactly how Shopify works but based on my experience with this kind of SAAS product the permissions you set in your extension are very close to a manifest related to API features.

  • so, theoretically, some harmful script (delete all products every 15 minutes), could be included in my code? Is there no other safety layer?
    – Kevin Wu
    Jan 26, 2016 at 13:56
  • ... Or delete all products and send all customer data to al qaeda. It's PHP all your actions are visible, in 6 year working with magento i never seen such actions in an extension. Jan 26, 2016 at 15:09
  • just saying....
    – Kevin Wu
    Jan 26, 2016 at 15:11
  • @Kevin Wu Me too! I'm just enforcing your concept you could do everything! Without any problem. In the new magento2 marketplace all extensions will be tested and manual reviewed, at least is what mage team says. Jan 26, 2016 at 15:19
  • Anyone know how to give write permission to folder in windows?
    – zus
    Dec 15, 2018 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.