[SaaS only]{class="badge positive" title="Applies to Adobe Commerce as a Cloud Service and Adobe Commerce Optimizer projects only (Adobe-managed SaaS infrastructure)."}

Private catalog views

By default, a catalog view is public. Enable catalog protection on a catalog view to restrict access to requests that include a valid signed token.

Catalog protection applies to the selected catalog view only. It does not change the view’s policies, layers, or price books.

See the Restricted access key use cases for examples of when to protect a catalog view.

Understand the protection boundary

Catalog protection applies only to the catalog view where it is enabled. It protects catalog and search requests but does not change the view’s policies or price books, protect other catalog views, or secure cart, checkout, or order operations.

The connected commerce backend must independently enforce purchase eligibility.

Protect a catalog view

Before you begin, create a restricted access key from the public key your client application generates.

Verify access is enforced

To confirm that a private catalog view rejects unauthorized requests, call its GraphQL endpoint with and without a signed token, using these headers:

A request without a valid token returns a GraphQL error instead of catalog data, for example:

{
  "errors": [
    {
      "message": "Access key validation failed: Missing token",
      "extensions": { "x-commerce-exception": "access-key-invalid" }
    }
  ]
}

A request carrying a token signed by an assigned, unexpired key returns the catalog data as expected. For details on signing a JWT and calling the Merchandising API, see the developer documentation.

Manage restricted access keys

If Catalog Protection is enabled and all assigned keys expire, the catalog view becomes inaccessible—storefronts that rely on this catalog view cannot serve data from it. Assign a new, unexpired key to restore access. For instructions, see Rotate keys.

More like this