Feed Security & Tokens
By default, a feed URL is public: anyone who has the URL can see your product data. Most stores leave it this way, because the URL is long and hard to guess, and ad platforms need to read it.
If you’d rather lock it down, turn on Feed Security. The feed then only responds when the request includes a secret token.
Turn on protection
Section titled “Turn on protection”- Go to Feeds and open the feed.
- Expand the Feed Security card.
- Turn on Require authentication.
- The Your Feed Token window shows the token and the Protected URL. Copy and store them somewhere safe.
- Click Done.
The feed header now shows a Protected badge, and Preview is turned off for this feed.
Use the token
Section titled “Use the token”Give the platform the token in one of two ways:
| Method | Example |
|---|---|
| Query parameter | https://feedy.lenuslabs.com/feeds/<feed-id>.tsv?token=YOUR_TOKEN |
| HTTP header | Authorization: Bearer YOUR_TOKEN |
Most ad platforms only accept a URL, so use the query parameter version (the Protected URL). Requests without a token get “Authentication required”, and requests with a wrong token get “Invalid token”.
Regenerate the token
Section titled “Regenerate the token”Do this if the token may have leaked, or you’ve lost it.
- In Feed Security, click Regenerate Token.
- Confirm. The old token stops working immediately.
- Copy the new token and Protected URL, then update every platform that fetches this feed.
Turn off protection
Section titled “Turn off protection”- In Feed Security, turn off Require authentication.
- Confirm Disable Protection.
The feed becomes public again and the old token is no longer needed.
Access log
Section titled “Access log”While protection is on, the feed page shows an access log of the last 50 attempts to fetch the feed with a token or without one. Each entry shows the time, result (Success, Invalid Token, No Token or Denied), IP address and browser or crawler name. Use it to confirm your platforms are fetching successfully, and to spot unexpected requests.
Good to know
Section titled “Good to know”- Protected feeds are limited to 30 requests per minute per IP address, which is plenty for ad platforms.
- Protected feed responses are never cached, so platforms always get the latest file.
- A token protects one feed. Each feed has its own token.