Manage API access

The API Access page lets you manage the tokens that your storefront, analytics, and developer integrations use to call the Layers APIs. From the API Access page you can create new tokens, rotate every token at once, and review the apps connected to your store. Managing API tokens requires the Manage API keys permission, which is available to the Owner, Admin, and Developer roles.

​

Create an API token

1. Go to Settings > API Access.
2. Create a token, give it a descriptive name, and select the permissions it needs.
3. Copy the token value and store it somewhere safe. You won’t be able to see it again.

​

Rotate API keys

Rotating keys regenerates the value of every API token on your store while keeping each token’s name, permissions, and default flag intact. Use it when a key may have been exposed, when an integration partner changes, or as part of a routine security review.

1. Go to Settings > API Access.
2. Click Rotate API keys in the page header.
3. Confirm the action in the dialog.
4. Copy the new token values from the tokens list and update each integration that uses them.

After rotation, event ingestion endpoints are resynced with the new keys before the old keys are revoked, so a correctly updated storefront keeps tracking without interruption.

​

Configure response options

Response options control which optional data Layers includes in storefront API responses. They have their own settings page, separate from your tokens.

1. Go to Settings > Developer > Response Options.
2. Turn on the options your storefront needs:
   • Allow Out-of-Collection Dynamic Linking: Let dynamic linking place linked products at the top of a collection even when they aren’t members of it. When it’s off, linked products outside the collection are skipped. See Linking products that aren’t in the collection.
   • Expose Variant Inventory: Include inventory quantity, inventory policy, and per-location inventory levels in the variant data the API returns. Turn it on if your storefront shows stock counts or hides sold-out variants. Leave it off to keep inventory data private.
   • List every pickup location: Show every pickup-enabled location in the pickup location facet on every collection and search, with a count of 0 where nothing in the results is stocked there. When it’s off, the facet only lists locations that stock a matching product. See Local pickup filtering.
3. Click Save.

All options are off by default. Changing them requires the Configure store settings permission.

​

Turn on Expose Variant Inventory

Storefront API tokens are used from shoppers’ browsers, so anyone who can load your storefront, including bots and competitors, can read the inventory data this option adds. Because of that, turning it on requires an explicit acknowledgement.

1. On the Response Options page, switch on Expose Variant Inventory.
2. Read the Expose variant inventory? dialog that opens.
3. Check the box confirming that you understand exact inventory levels become publicly readable and that you’re authorized to enable this for the store.
4. Click Agree and enable, then click Save.

Click Cancel in the dialog to leave the option off. Turning the option off, or saving the page while it’s already on, doesn’t ask for an acknowledgement. Layers records who turned the option on or off, when, and the statement they agreed to. The toggle shows the latest record:

• Enabled by a team member, with when they agreed to the acknowledgement and its version.
• Enabled before acknowledgements were tracked. No agreement on record. The option was already on before Layers started recording acknowledgements.
• Disabled by a team member, with when they turned it off.

​

Review app connections

The App Connections table lists every OAuth app that a team member has connected to this store, such as MCP clients authorized through the Layers MCP server. Each row shows the app, the user who authorized it, and its current access.

• App — the connecting app’s name and OAuth client ID, with its logo if the app supplied one.
• Connected by — the team member who authorized the connection. A connection can never exceed that user’s own access.
• Current access — the permissions the connection can currently exercise. Layers intersects the permissions the user originally granted with the permissions that user still has today. Tightening a role automatically narrows every connection it created.
• Status — Valid when the connection retains at least one working permission, or No access when permission changes have left the connection with nothing it can do. No access rows are safe to revoke.

Use the search box to filter by app name, user, or permission. When a connection lists many permissions, the row shows the first three as badges and collapses the rest behind a count; hover the count to see the full list.

​

Revoke an app connection

Revoking a connection immediately cuts off the app’s access to your store. The user who originally authorized it can reconnect from their MCP client, which starts a fresh authorization with your current role permissions. Revoke a connection when the app is no longer in use, when the connection shows No access, or when you want to force a reauthorization after a role change.

1. Go to Settings > API Access.
2. In the App Connections table, open the row’s actions menu and select Revoke access.
3. Confirm Revoke connection in the dialog.

If the connection was authorized with Include future stores, revoking it here also excludes this store from that setting. Layers won’t re-grant the store to the connection automatically. A fresh authorization from the MCP client resets the exclusion. Revoking an app connection requires the Manage API keys permission. To narrow every connection created by a user without revoking individual rows, adjust their role’s permissions instead. Layers automatically tightens each existing connection to match.

​

Next steps

• Navigate settings to explore other store configuration options.
• Manage team members to control dashboard access.
• Manage roles and permissions to control who can manage API tokens.