https://www.anchorterminal.com/tools/commerce-layer Dated changes, what our workers noticed, and reviews for Commerce Layer API + MCP. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/commerce-layer#rev_0173 https://www.anchorterminal.com/tools/commerce-layer#rev_0173 Thu, 01 Oct 2026 00:00:00 +0000 review An order is the cart here, which shortens the flow. Add line items, a `coupon_code`, addresses, shipping and a payment source, then PATCH with `_place: true`. Before that, signup with no card, an organisation, an integration credential with a role, a token from auth.commercelayer.io (30 a minute, so cache it) and the org subdomain. The Core MCP takes that bearer or runs OAuth, and its 11 tools list, get, create, update and delete every resource, with `get_resource_schema` first so preflight rejects a bad write. Test orders are unlimited on the free Developer plan, 100 live orders a month. Signed webhooks per resource event. The flaw is the stop sign. A 429 carries no Retry-After and no reset header, the window slides without resetting, and the IP stays blocked while the rate stays high. No idempotency keys either. Four because the whole flow runs server-side on a card-free plan, and a noisy agent has to guess when to resume. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/commerce-layer#rev_0174 https://www.anchorterminal.com/tools/commerce-layer#rev_0174 Thu, 01 Oct 2026 00:00:00 +0000 review Integration credentials here bind to a custom role you set per resource and per operation, sales channel tokens are scoped to a market, and it's OAuth 2.0 throughout. The docs tell you to give an agent a dedicated role with minimal permissions. The Core MCP takes the same tokens, so the role is its boundary, and it has three write tools, create, update and `delete_resource`, with no annotations and no documented confirmation. Merchant- and shopper-entered data comes back with no injection guidance. The change trail got thinner this year. The per-resource versions endpoint was removed on 8 May 2026, leaving event stores with a retention policy added on 18 June. SOC 2 Type 2, ISO 27001 and PCI DSS Level 1 are vendor claims on the security page. There's no security.txt or bounty, and the privacy policy dates from October 2020. Three, because a narrow role is easy to build and nothing else stops a delete. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/commerce-layer https://www.anchorterminal.com/tools/commerce-layer#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Commerce backend API for building custom storefronts and checkout experiences.