Feed Security & Tokens
Feed URLs contain your product data. While URLs are unique and hard to guess, you can add token authentication for extra security.
Security Options
Section titled “Security Options”| Option | Security Level | Ease of Use |
|---|---|---|
| Public URL | Basic | Easiest |
| Token required | Enhanced | Easy |
| Token + IP restriction | High | Moderate |
Understanding Feed Security
Section titled “Understanding Feed Security”Public Feeds (Default)
Section titled “Public Feeds (Default)”By default, feeds are accessible to anyone with the URL:
https://app.smartfeed.app/feeds/abc123.xmlSecurity notes:
- URL is unique and random
- Not indexed by search engines
- Don’t share publicly
Protected Feeds
Section titled “Protected Feeds”Add token requirement:
https://app.smartfeed.app/feeds/abc123.xml?token=your-secret-tokenRequests without valid token receive 403 error.
Enabling Token Protection
Section titled “Enabling Token Protection”-
Go to feed settings
Navigate to Feeds > select feed > Settings.
-
Enable authentication
Toggle Require authentication on.
-
Copy generated token
A 32-character token is generated. Copy it.
-
Save settings
Click Save. Feed now requires token.
-
Update platform configuration
Add token to your feed URL in each platform.
Using Tokens
Section titled “Using Tokens”Query Parameter
Section titled “Query Parameter”Add token as URL parameter:
https://app.smartfeed.app/feeds/abc123.xml?token=abc123def456ghi789HTTP Header
Section titled “HTTP Header”Or use Authorization header:
Authorization: Bearer abc123def456ghi789Token Management
Section titled “Token Management”Regenerating Tokens
Section titled “Regenerating Tokens”If token is compromised:
- Go to feed settings
- Click Regenerate Token
- Copy new token
- Update in all platforms
Old token stops working immediately.
Multiple Tokens (Enterprise)
Section titled “Multiple Tokens (Enterprise)”Enterprise plans support multiple tokens per feed:
- Different token per platform
- Revoke individual tokens
- Track usage per token
Access Logging
Section titled “Access Logging”Monitor who accesses your feeds:
- Go to feed > Access Log
- View recent requests
- See:
- Timestamp
- IP address
- Token used
- Success/failure
Identifying Unauthorized Access
Section titled “Identifying Unauthorized Access”Look for:
- Requests with wrong token (401 errors)
- Unexpected IP addresses
- Unusual access patterns
IP Restrictions (Enterprise)
Section titled “IP Restrictions (Enterprise)”Restrict feed access to specific IPs:
- Go to feed settings
- Enable IP whitelist
- Add allowed IP addresses/ranges
- Save
| Platform | IP Ranges |
|---|---|
| Published ranges | |
| Variable | |
| Others | Check documentation |
Security Best Practices
Section titled “Security Best Practices”- Use token protection for sensitive data
- Monitor access logs regularly
- Regenerate tokens periodically
- Use HTTPS (always enabled)
Don’ts
Section titled “Don’ts”- Share feed URLs publicly
- Use simple or guessable tokens
- Ignore failed access attempts
- Disable protection without reason
Token Security
Section titled “Token Security”How Tokens Work
Section titled “How Tokens Work”- 32-character random string
- Stored as hash (not plaintext)
- Compared on each request
- Constant-time comparison (timing attack safe)
Token Strength
Section titled “Token Strength”Feedy McFeed Feed tokens are:
- Cryptographically random
- Sufficient entropy (256 bits)
- Resistant to brute force
Platform-Specific Setup
Section titled “Platform-Specific Setup”Google Merchant Center
Section titled “Google Merchant Center”- Copy feed URL with token
- In GMC, add/edit feed
- Use full URL including
?token=... - Test fetch
Facebook Commerce Manager
Section titled “Facebook Commerce Manager”- Copy feed URL with token
- In Commerce Manager > Data sources
- Enter full URL with token
- Verify connection
Other Platforms
Section titled “Other Platforms”Most platforms accept tokens in URL. Check platform documentation for header-based auth support.
Troubleshooting
Section titled “Troubleshooting”Platform can’t fetch (403 error)
Section titled “Platform can’t fetch (403 error)”Causes:
- Token missing from URL
- Token incorrect
- Token regenerated
Solutions:
- Verify URL includes token
- Copy token again
- Update platform configuration
Access denied after setup
Section titled “Access denied after setup”Check:
- Token enabled in settings
- Correct token in URL
- No IP restrictions blocking
Token works in browser but not platform
Section titled “Token works in browser but not platform”Possible causes:
- Platform caching old URL
- Header vs parameter issue
- Network restrictions
Solutions:
- Clear platform cache
- Try different auth method
- Check platform logs