On a shopify app, the OAuth scopes are defined on config/initializers/shopify_app.rb. To define multiple scopes:

config.scope = "read_products, read_content, write_content, read_themes, write_themes, write_products, read_product_listings, read_customers, write_orders, read_analytics, read_checkouts, read_reports"

More info n scopes: https://shopify.dev/docs/admin-api/access-scopes