How to Enable Device Permissions like Camera and Location for Shop Features?
Questions:
- Why is my store camera or location feature not working?
- How do I allow browser permissions for location or payments?
- How do I fix features that require user device access?
Description:
What you notice: a feature that needs the visitor's camera, microphone, location, or a built-in payment prompt does nothing — sometimes without even asking the visitor for permission.
Why this happened: These are powerful, sensitive features. To protect your visitors, your shop now switches all of them off by default. A tool can only use the camera, microphone, location or payment features if you deliberately allow it. This prevents a rogue or hacked tool from quietly switching on a visitor's camera or tracking their whereabouts. So if you've added a genuine feature that needs one of these — for example a "find my nearest store" map that uses location — you simply need to turn that one feature on.
Solution:
-
Open Permission Policies
Go to System Configuration → Security Configuration → Permission policies.
-
Locate the Required Feature
- Find the feature you need in the list. The everyday ones are:
- location (geolocation) — "find nearest store", local delivery checks
- camera / microphone — video try-on, scan-a-code, recording
- payment — browser payment prompts
- fullscreen — full-screen videos or galleries
- Find the feature you need in the list. The everyday ones are:
-
For ex : Geolocation and Payment permissions
-
Configure the Access Settings
- To let your own shop use it, turn it on for your own site (the usual choice),
- To let an embedded outside tool use it, add that tool's web address.
- Save and reload.
Tips and Tricks:
If the feature lives inside an embedded box (like a video or map), you may also need to allow that box itself — see How to Fix Blank Embedded Videos and Maps on Your Website.
Pro-Tips:
-
These features only ever work on a secure connection — which your shop already guarantees. So there's nothing else to set up on that side.
-
If you're not sure which item in the list matches your feature, hand this article to your web agency or our support team and they'll switch on the right one.
Warnings:
-
Only grant permissions to verified and trusted outside tools to prevent security vulnerabilities or unauthorized data tracking.
-
Features requiring device permissions will fail to load if your site does not maintain a secure HTTPS connection.
Note for your agency: This is the Permissions-Policy header. All features ship with an empty allowlist (denied for everyone). Allowlist values: self, specific origins, or *. Legacy keys fullScreen / publickeyCredentials(Get) are mapped to the standard feature names automatically.