e.sy access guard - Admin, API & 2FA Security

by bgp e.media GmbH

Protect your Shopware Administration, Admin API and integrations with IP allowlists, 2FA, audit logs and controlled audit or enforcement modes for safer operations.

Expected release: August 2026

Compatible with:

Self-hosted

Includes:

All updates

During the subscription all released updates are included for free

Support from the Extension Partner

In case you have any problems with your extension you can always ask the Extension Partner for help.

Description

Highlights

IP allowlists for admin login, Admin API, Store API and integrations
Enforceable 2FA with OTP, WebAuthn, passkeys and security keys
Audit mode for safe testing before enforcement
Central overview of protected, blocked and logged access
Audit logs with retention, cleanup task and emergency fallbacks

Features

Protection for Shopware Administration login and /api/oauth/token
Rechecks every Admin API request against the allowed IP
IP rules for system integrations
IP rules for user integrations and access keys
Inheritance of IP rules from admin users and their roles

IP rules for admin users and admin roles
Global administrator allowlist for administrators and super admins
Optional Store API protection for selected routes or globally
Support for IPv4, IPv6 and CIDR
Audit-only and enforcement mode
Audit log with status, reason, IP address, route, method and guard source
Filter for blocked access
Enforceable 2FA with OTP or WebAuthn
User self-service for 2FA setup and device management
Log level, retention period, cleanup command and scheduled task

Show more Show less

About the Extension

Targeted access protection for Shopware Administration, APIs and integrations

e.sy access guard protects sensitive Shopware access points with IP allowlists, two-factor authentication and transparent audit logs. Control which admin users, roles, system integrations, user integrations and Store API routes may be used from specific IP addresses.

The audit mode lets you roll out protection safely: first review which requests would be allowed or blocked, then switch to enforcement when your rules are ready. For stronger account security, you can enforce 2FA with OTP or WebAuthn and protect administrators, super admins and integrations separately.

Ideal for shops working with external agencies, ERP/PIM connections, remote teams or higher security requirements.