Locksmith questions, answered.

Locksmith is a Shopify app for access control in the Online Store channel. You lock products, collections, pages, prices, or the whole store, and decide who gets in with keys made of conditions, such as a customer tag, a passcode, a secret link, a location, or a purchase history.

Locksmith is made by Lightward, which also makes Mechanic. It launched on the Shopify App Store in 2014, carries the Built for Shopify badge, and won a 2025 Shopify Build Award.

A lock decides what's restricted. A key is a way in, and a lock can have several; any key that works opens the lock. A condition is something that must be true, like "customer is tagged with wholesale". A key can hold several conditions, and it works only when all of them are true.

The entire store, products, products by tag, collections, all products, product variants, vendors, pages, blogs, articles by tag, search, the cart, the customer login and registration pages, and prices and add-to-cart buttons. Developers can also write locks in Liquid.

Customer conditions (signed in, tagged with, email address on a list or from a domain, number of orders, has purchased), passcodes and passcode lists, secret links, visitor location, IP address, store domain, a confirmation prompt, dates, times and weekly schedules, cart contents and cart value, Klaviyo and Mailchimp list membership, and custom Liquid. Every condition can be inverted.

Yes. Lock the products and turn on price and add-to-cart hiding. Guests see a sign-in prompt where the buy buttons were, and customers who meet your conditions see prices. No theme code is needed for most themes.

Locksmith adds a noindex tag to locked pages by default, and it can remove locked items from your sitemap and storefront search. It treats search engines exactly like visitors, so a crawler sees what a visitor without access sees. Pages locked by location or IP address generally can't be indexed.

It's possible. Locksmith hides prices in your theme's product templates, but SEO markup and analytics tools can still include prices in the page source. The cart and checkout always show prices, so hide buy buttons whenever you hide prices.

Use checkout validation to prevent that. It only lets customers with the right tags buy products with matching tags, even through cart permalinks or bots.

Location is based on the visitor's IP address, so it's approximate, and visitors using a VPN may appear to be somewhere else. To control where orders ship, use Shopify's shipping settings as well.