Security & permissions

What an assistant can access

A connection can read and change one business's storefront, the business you picked when connecting:

• pages, page folders and redirects;
• page content, styles, components, fonts, color variables and animations;
• your own CMS collections and their items;
• the asset library;
• forms and their settings;
• locales and translations;
• site settings;
• publishing.

It can read your shop context (business profile, brand, currency, catalogue summary and synced catalogue collections) so it can design around your products.

It cannot:

• edit products, prices, categories or any other synced catalogue data;
• see or change payments, invoices, customers, orders or accounting;
• access any other business on your account;
• do anything you could not do yourself in the storefront builder.

Who can connect

Only Admins and Managers of a business can connect an assistant, the same people who can open its storefront builder. Every connection acts as the person who approved it.

Isolation between businesses

Each token belongs to exactly one business. Every request to the MCP server runs inside that business, so tools only ever see and change that storefront, even when the same person has several businesses. MCP sessions are also bound to their business.

Access follows your Cashfin access

Cashfin re-checks the person behind a connection continuously. Remove someone from the business, revoke their builder access in Settings → Users, or change their role so that they can no longer open the builder, and their connections stop working within about a minute.

OAuth security

• Authorization code flow with PKCE (S256) only.
• Exact redirect URI matching (loopback ports excepted, per RFC 8252).
• Single-use authorization codes valid for 10 minutes.
• Access tokens valid for 1 hour; refresh tokens rotate on every use and are bound to the client they were issued to.
• Refresh tokens are stored hashed.
• The business is chosen on the Cashfin accounts screen and enforced on the consent screen and when the code is issued.

Good practice

• Prefer OAuth. Use URL tokens only for clients that cannot do OAuth, and never share or commit them.
• Keep publish and delete tools on ask in your assistant. See Publishing.
• Review Integrations → MCP → Connections from time to time and revoke anything you no longer use.
• Connect only assistants you trust. An assistant acts with your permissions on the storefront.

Reporting a vulnerability

If you find a security issue, email [email protected] with the details. Please do not share it publicly until it has been fixed.