Your Mapbox access token is visible in your website's code. That's normal, because every visitor's browser needs it to load your map. A URL restriction tells Mapbox to accept your token only from the websites you list.
Before you start
If your map uses a private custom style, use the Mapbox account that owns that style.
Mapbox doesn't allow restrictions on your Default public token, so you'll create a new token for StoreRocket.
If your Mapbox account has demo access, Mapbox asks for a payment method first and moves you to pay-as-you-go. If your current token is already on your map, choose Keep token during the upgrade so the map keeps working.
Step 1: Create a restricted token in Mapbox
Open your Mapbox access tokens page.
Click Create a token and give it a name you'll recognise, like
StoreRocket.Keep the default public scopes selected. Your map needs them.
In the URL restrictions part of the form, add each address your map appears on (see the list below).
Click Create token, enter your Mapbox password to confirm, and copy the new token.
What to add to the URL list
Add just the domain, like example.com, without page paths or *. A domain also covers its subdomains, so example.com covers www.example.com too.
Always add:
Your website's domain, for example
example.comstorerocket.io, so the map keeps working in your StoreRocket Preview page, in the floating button and on StoreRocket-hosted locator links
Also add these if they apply to you:
If your locator is on | Also add |
Shopify | your |
Wix | your |
Squarespace | your |
Webflow | your |
A staging or test site | its domain |
Each address you add is one more place your token works, so only add the ones you use.
Step 2: Put the new token in StoreRocket
Go to Map Provider in StoreRocket.
Paste the new token into Mapbox Access Token and click Save.
StoreRocket's own token check doesn't send a website address for Mapbox to check, so after you save, the page will say your Mapbox access token is invalid. The small preview on the Install page doesn't send one either, so it will show a blank map. The token is still saved, and if the map loads on your website, it's working.
Step 3: Test before you remove the old token
Open your store locator page in a private or incognito window.
Check that the map loads, then search for a city.
Do the same on every page that has your locator. Click any floating button to open its map, and try any search box.
Open the Preview page in StoreRocket and check the map there too.
When everything works, go back to Mapbox and delete your old token, so any copies of it stop working. Only do this if nothing else uses the old token, including other StoreRocket projects. If the old token is your Default public token, use its refresh button instead, click Yes, refresh token and enter your password to finish. Maps that were already loaded somewhere may keep showing for a little while.
Troubleshooting
The map is blank after locking the token
A blank map can mean an address is missing from your list, your browser isn't sending the website address (some privacy extensions block it), or a problem with the token. Check the list for typos and try a private window without extensions. If your old token hasn't been deleted or refreshed, you can paste it back into Map Provider while you fix it. If the map still doesn't load, message us on live chat.
Does this make my token completely safe?
No setting can hide a map token, because browsers need it to show the map. Mapbox describes URL restrictions as a best-effort protection that reduces other websites reusing your token. It's worth checking your token's usage in your Mapbox account from time to time.
Where do I add the token in the first place?