Private catalog views
By default, a catalog view is public. Enable catalog protection on a catalog view to restrict access to requests that include a valid signed token.
Catalog protection applies to the selected catalog view only. It does not change the view’s policies or layers. It does restrict the view to a single price book—see Price book restriction on private catalog views.
See the Restricted access key use cases for examples of when to protect a catalog view.
Understand the protection boundary
Catalog protection applies only to the catalog view where it is enabled. It protects catalog and search requests but does not change the view’s policies or layers, protect other catalog views, or secure cart, checkout, or order operations.
The connected commerce backend must independently enforce purchase eligibility.
Price book restriction on private catalog views
A private catalog view can reference only one price book. This differs from a public catalog view, which can use multiple price books.
When Catalog Protection is enabled, the price book selector on the catalog view form switches from a multi-select control to a single-select (radio button) control.
- If you enable Catalog Protection on a catalog view that has multiple price books assigned, you cannot save the view until you remove all but one price book.
- If you previously saved a private catalog view with multiple price book assignments before this restriction existed, the catalog view configuration is not automatically changed. However, the next time you edit the view, you must remove all but one price book before you can save the updates.
In each of these cases, Adobe Commerce Optimizer displays the following validation message: A protected catalog view can use only one price book. Select 'Single price book only' to continue.
Public catalog views are unaffected by this restriction and can continue to reference multiple price books.
Protect a catalog view
Before you begin, create a restricted access key from the public key your client application generates.
-
On the catalog view create or edit form, toggle Catalog Protection to Enabled.
-
Under Restricted Access Keys, select up to three restricted access keys to assign to this catalog view.
-
Click Save catalog view.
The catalog view is now protected. Only requests carrying a valid signed token from an assigned key can retrieve its data.
note NOTE Allow up to five minutes for Catalog Protection configuration changes to take effect.
Verify access is enforced
To confirm that a private catalog view rejects unauthorized requests, call its GraphQL endpoint with and without a signed token, using these headers:
AC-View-IDAC-Price-Book-IDAC-Catalog-View-Access-TokenA request without a valid token returns a GraphQL error instead of catalog data, for example:
{
"errors": [
{
"message": "Access key validation failed: Missing token",
"extensions": { "x-commerce-exception": "access-key-invalid" }
}
]
}
A request carrying a token signed by an assigned, unexpired key returns the catalog data as expected. For details on signing a JWT and calling the Merchandising API, see the developer documentation.
Manage restricted access keys
If Catalog Protection is enabled and all assigned keys expire, the catalog view becomes inaccessible—storefronts that rely on this catalog view cannot serve data from it. Assign a new, unexpired key to restore access. For instructions, see Rotate keys.
More like this
- Catalog views—Learn how catalog views organize your product catalog by business structure, policies, and pricing.
- Restricted access keys—Create, assign, and rotate the keys used to sign tokens for Catalog Protection.