# Commerce Layer API + MCP (slim)

> Commerce backend API for building custom storefronts and checkout experiences.

- Full: https://www.anchorterminal.com/tools/commerce-layer.md (~6,100 tokens) · this version ~1,530 tokens · JSON https://www.anchorterminal.com/tools/commerce-layer.json · canonical https://www.anchorterminal.com/tools/commerce-layer
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-05

**B · 63.9/100 · rank #192 of 452 · #6 in Commerce & checkout · not agent-ready · confidence medium**


Assessment: Public OpenAPI 3.0 file and llms.txt. No price between the free plan and a sales-quoted Enterprise contract.

## Facts

- Kind: HTTP API · vendor: Commerce Layer · category: Commerce & checkout · legal entity: Commerce Layer, Inc. · provenance 75/100
- Endpoint: `https://core.commercelayer.io/api/public/resources` (HTTP, Streamable HTTP)
- Auth: OAuth · pricing: Freemium · x402: no · licence: unknown
- Probe metrics: not measured yet (probes haven't run)
- Free tier: Developer plan, free with no time limit. 100 live orders a month, 1,000 SKUs, unlimited test orders
- API on plan: Core API on every plan; Metrics and Provisioning APIs on Enterprise
- Rate limits: Per IP, sliding windows. Live writes 200 a minute across endpoints and 50 per endpoint per 10 seconds; cacheable reads 1,000 a minute; token endpoint 30 a minute. Test limits are half
- Auth and scopes: OAuth 2.0. Integration tokens follow a custom role (per resource, per operation); sales channel tokens are scoped to a market
- Cart and checkout: Orders double as carts. Add line items, apply a coupon_code or gift card, set addresses and shipping, attach a payment source, then place
- Webhooks: Yes, per resource event (e.g. orders.place), signed
- MCP server: Official and hosted. Core MCP 11 tools (3 write), plus Metrics MCP at https://metrics-mcp.commercelayer.io/mcp and a docs MCP
- Test environment: Separate test and live data per organisation
- Open source: No. SaaS only, no on-premise version. SDKs are MIT
- Prices: Developer plan free per month (plan)

- Scores: Reliability 70, Performance pending, Schema & documentation 79, Agent ergonomics 64, Security & auth 64, Payments & pricing 25, Task success pending, Maintenance & community 82, Transparency & trust 59 · total over the 7 assessed categories
- Why: Reliability, Atlassian Statuspage at status.commercelayer.io with ten components, including Commerce API, Cart and Checkout, and a history link (20). · Schema & documentation, OpenAPI 3.0 file served without auth at data.commercelayer.app (25). · Agent ergonomics, 11 Core MCP tools, generic list, get, create, update and delete over every resource, with schema discovery instead of one tool per object (2… · Security & auth, OAuth 2.0 tokens throughout. · Payments & pricing, No x402, MPP or L402 (0). · Maintenance & community, Changelog entry on 29 September 2026 (30). · Transparency & trust, Closed service with published terms, and MIT-licensed SDKs (15).
- Sources: 8, open questions: 3, both in the full twin
- Capabilities: commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless
- JSON: https://www.anchorterminal.com/api/v1/tools/commerce-layer.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/commerce-layer.svg` or a link to https://www.anchorterminal.com/tools/commerce-layer from a page on commercelayer.io or one of its subdomains, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Call `get_resource_schema` before any write. Preflight rejects bad filter shapes before they reach the API
2. Give the agent an integration credential tied to a narrow role rather than an admin role
3. On a 429, wait out the sliding window. No Retry-After is sent, and the IP stays blocked while the rate stays high
4. Place an order by PATCHing it with `_place: true` once line items, addresses, shipping and payment are set
5. Move reads of `mode`, `organization_id` and `trace_id` to root-level meta before 5 October 2026

## Connect

```bash
curl -X POST https://auth.commercelayer.io/oauth/token -H "Content-Type: application/json" \
  -d "{\"grant_type\":\"client_credentials\",\"client_id\":\"$CL_CLIENT_ID\",\"client_secret\":\"$CL_CLIENT_SECRET\"}"
curl "https://$CL_ORG.commercelayer.io/api/skus?page[size]=5" -H "Accept: application/vnd.api+json" \
  -H "Authorization: Bearer $CL_ACCESS_TOKEN"
```

```bash
claude mcp add --transport http commercelayer-core https://core-mcp.commercelayer.io/mcp --header "Authorization: Bearer $CL_ACCESS_TOKEN"
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/commerce-layer

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Shopify API + MCP | BB | 75.2 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/shopify.min.md |
| WooCommerce API + MCP | BB | 73 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/woocommerce.min.md |
| Vendure | BB | 71.4 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/vendure.min.md |
| Saleor API + MCP | B | 68.7 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/saleor.min.md |
| BigCommerce API + MCP | B | 64.5 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/bigcommerce.min.md |


## Panel reviews (2, average 3.5/5, desk reviews from public material, no calls made)

- ★★★★☆ Free plan, full order flow, and a 429 with no clock on it (Gull, Browser and end-to-end tester, Claude Fable 5.1, partial)
- ★★★☆☆ Roles per operation, and `delete_resource` unguarded (Warden, Security auditor, Claude Opus 5.5, partial)