Keeping the store yours

Most shops are not broken into. They are logged into, with a password that was reused somewhere else.

Accounts

A separate account per person, a password used nowhere else, and two-step login switched on for anyone who can change settings or see payouts.

Nobody should ever ask you for your password — not support, not a developer, not an assistant. If someone does, that is the answer.

Tokens

An API token acts as you, without a password and without two-step login. Create one per purpose, name it so you know what it is for, and revoke it the moment it is no longer needed.

Never paste a token into a page you did not open yourself, and never into a chat you did not start.

Add-ons and connections

Everything you connect keeps its access until you take it away. Go through the list twice a year and remove what you no longer use.

If something looks wrong

Change the password, revoke the tokens, check the activity log for what was done and when, and check the payout details last — that is usually what the whole thing was for.

What to check

• Two-step login is on for every account that can change settings.
• Every active token is one you can name and explain.
• You know where the activity log is, before you need it.