How Simple Bundles secures your store data with IP allowlists and expiring access tokens

Simple Bundles uses an IP allowlist and expiring access tokens to keep your store and customer data secure. Both are already in place, and there's nothing you need to set up.

What is the IP allowlist?

Shopify only accepts requests made with Simple Bundles' access tokens when they come from our own servers. A token used from anywhere else is rejected, even if it's valid. This meets Shopify's IP allowlist requirement for public apps.

What are expiring access tokens?

The tokens Simple Bundles uses to connect to your store expire after a short time and renew automatically. If a token were ever exposed, it would stop working quickly.

Do I need to do anything?

No. There's nothing to change in your Shopify admin or in Simple Bundles, and your storefront and checkout aren't affected.

To check this yourself, go to Settings > Apps in your Shopify admin and open Simple Bundles. In the Security section, "Expiring access tokens" and "Enforced IP restrictions" should both have a green check. If either one shows as missing, email us at hello@simplebundles.io and we'll look into it.

For other security questions, see the Simple Bundles security center or email hello@simplebundles.io.