Locksmith

For developers & agencies

Access control you can script.

Most Locksmith setups need no code. When a client's rules don't fit a checkbox, write conditions and locks in Liquid, read access state in the theme or from JavaScript, and manage locks from your own systems.

Read the developer docs See examples

Building for a client? Tell us about the project and we'll help you decide whether Locksmith fits.

Four layers

Start in the app. Drop to code when you need to.

  1. Custom Liquid conditions

    Any condition Shopify's Liquid can express: metafields, cart contents, locale.

  2. Theme variables

    Read access_granted and friends to lock part of a template.

  3. Storefront API

    Check access for a list of URLs from JavaScript.

  4. Admin API

    Create locks, attach resources, and sync input lists from your backend.

Custom Liquid key conditions

Write the rule yourself.

A custom Liquid condition is an if statement that Locksmith evaluates for each visitor. Put it in a key alone or alongside built-in conditions; when every condition in the key is true, the lock opens. Use an optional prelude to assign variables first. Public metafields, the cart, and the customer object are all available.

Custom Liquid condition basics →

{% comment %} Open for customers whose public
   metafield marks them as approved {% endcomment %}
{% if customer.metafields.namespace.key == "matching-value" %}

{% comment %} Open once the cart has five or more items {% endcomment %}
{% if cart.item_count > 4 %}

Theme variables & manual mode

Lock part of a page.

Turn on manual mode for a lock, and Locksmith leaves the page alone. Your theme decides what to show by reading Locksmith's variables: locked, access_granted, access_denied, hide_resource, lock_ids, key_ids, and more.

Manual mode tutorial →   All variables →

{% capture var %}{% render 'locksmith-variables', variable: 'access_granted', scope: 'subject', subject: product %}{% endcapture %}
{% if var == 'true' %}
  {% assign locksmith_access_granted = true %}
{% else %}
  {% assign locksmith_access_granted = false %}
{% endif %}

{% if locksmith_access_granted %}
  You've got access!
{% endif %}

Storefront API

Ask from JavaScript.

Request access state for one or more storefront URLs from the visitor's browser. The response has one entry per URL with the same values as the Liquid variables. Parse the body as JSON, whatever its content type says.

Storefront API docs →

const res = await fetch(
  '/apps/locksmith/api/resources?urls[]=/products/short-sleeve-t-shirt'
);
const state = JSON.parse(await res.text());

state['/products/short-sleeve-t-shirt'];
// { locked: true, access_granted: true, access_denied: false,
//   manual_lock: false, hide_resource: false, ... }

Admin API

Manage locks from your backend.

Generate an access token in Locksmith's settings, then list, create, and delete locks, attach resources to them, and trigger an input-list sync after you update the source data. It's meant for servers, not themes.

  • GET /locks.json and GET /locks/:id.json
  • POST /locks/:lock_id/resources
  • POST /input-lists/:id/sync

Admin API docs →

curl \
  --header "x-shopify-shop-domain: example.myshopify.com" \
  --header "x-locksmith-access-token: xxxxxxxx" \
  https://uselocksmith.com/api/unstable/shop.json

Works well with

Locksmith and the rest of the stack.

Mechanic

Lightward's automation platform. Tag customers when they qualify, or feed an input list from a Mechanic cache, and let Locksmith grant access.

mechanic.dev →

Subscription apps

ReCharge, PayWhirl, Seal Subscriptions, and Appfox tag active subscribers. Locksmith uses the tag as a key condition.

Membership guide →

Klaviyo & Mailchimp

Use list and segment membership as a key condition, and collect signups with Locksmith's email prompt.

Klaviyo guide →

Put the first lock on your store today.

Your price follows your Shopify plan, not the features you use. Every plan starts with a 15-day free trial.

Install Locksmith Ask us about your setup