Appstle Subscriptions

The Corma and Appstle Subscriptions integration keeps access to your subscription business in line with your e-commerce team. Appstle Subscriptions is a Shopify app for selling and managing recurring products, built by Appstle Inc., and Shopify stores the subscription contracts natively once the app is installed. Appstle documents no user seats of its own: Shopify roles decide which staff can open apps, and the credentials to watch are Appstle's store API keys.

Key takeaways

• Appstle Subscriptions plans on the Shopify App Store are tiered by monthly subscription revenue, and the listing mentions no per-user charge.
• Shopify roles control which staff can open apps such as Appstle, and a Shopify role can be limited to specific apps.
• An Appstle store can hold up to 10 active API keys, Read & Write by default, and a key's permission cannot be changed after creation.
• Only the store owner, staff with Full access in Shopify and staff the owner authorizes can view and create Appstle API keys.

Who controls Appstle in your Shopify store?

Two layers decide access. In Shopify, a role can be limited to specific apps, users limited this way cannot install or delete apps, and installing a paid app needs the separate Approve app charges permission. Shopify's admin app permissions do not change permissions set inside an app, so Appstle's own API access settings are a second control. Shopify plans also cap users, from none on Starter and Basic and 5 on Grow to unlimited on Shopify Plus, with collaborators and POS-only staff outside the limit.

In Appstle, the credentials are store API keys. Appstle's documentation limits key creation to the store owner, staff with Full access in Shopify and staff the owner authorizes, one by one or all at once. Each key shows its permission and when it was last used, and revoking it stops it immediately, but the documentation does not say who created a key or whether it is revoked when that person leaves. Uninstalling Appstle deletes all merchant and customer data for the store from Appstle's systems.

How Corma governs Appstle Subscriptions

• Staff mapped to people: Corma governs Shopify staff accounts like any other app, as described on our Shopify page, so accounts of people who left stand out.
• Leavers with a key check: a leaver workflow in the IT Workflow Builder asks the store owner to revoke any Appstle API key the person used and to remove them from the authorized user IDs.
• Keys with an owner: Appstle API keys and partner tokens are non-human identities, so each one needs a named owner and a regular check of its last use.
• Plan in view: the Appstle plan and its monthly charge sit in SaaS subscription management, next to the rest of your stack.

Frequently asked questions

Does Appstle Subscriptions support SSO or SCIM?

Appstle's documentation mentions neither. Appstle documents no logins of its own, and in Shopify a staff user can be deactivated so they can no longer log in, while removing a user is permanent. Learn what single sign-on covers.

How does Corma connect to Appstle Subscriptions?

Through Shopify for staff accounts and app permissions, and through Corma's browser-based agents for Appstle's API access settings, in an isolated browser session with credentials taken from your password vault.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who holds the keys to your subscription data? Book a Corma demo.