AI permissions and safety

What AI can and cannot change, confirmations, dry runs, idempotency, audit and rate limits.

AI tools connected over MCP work as you, in one store, through the same API and permissions as the dashboard. On top of that, ShopFast adds rules of its own.

Never available to AI

No tool exists for these, and call_api refuses them:

• Money out of the store: payouts, withdrawals, the payout wallet, crypto payout settings, affiliate payouts.
• Paying ShopFast: plan changes, billing cards, invoices, and moving money into AI credits.
• Who can get in: API keys, OAuth apps and connections, storefront keys, the team’s two-factor rule, ownership.
• Secrets: revealing or rotating webhook secrets and license keys in full.

These are the same lists Ask AI follows and Login as refuses, so every AI surface in ShopFast agrees.

Who can connect

AI is for the store owner unless the owner turns on Use AI for a teammate (Settings → Team & Roles). A teammate without it cannot approve an AI tool, and an API key they created does not open the MCP server. With it, the AI is still capped by their role.

Scopes

An AI tool gets the scopes you approved: every area, read only, or read and change. A read-only connection never sees a tool that changes anything.

Confirmations

Some changes wait for you every time: refunds, deletes, anything that emails a buyer, publishing a theme, test sales, webhook endpoints, and changes to payments and the team. The first call answers:

{
  "status": "confirmation_required",
  "confirmationToken": "mcpc_…",
  "expiresAt": "2026-10-28T12:10:00.000Z",
  "preview": { "request": { "method": "POST", "path": "/v1/store/orders/ord_…/refunds", "body": { "amountMinor": 2400 } } }
}

The AI shows you the preview in plain words. Only after you agree does it call the same tool again with the same input and the confirmationToken. The token works once, for 10 minutes, for exactly that change: a different amount, order or connection is refused.

Dry runs

Every change tool takes dryRun: true. ShopFast checks the input and your permissions, shows what would change (the current record next to the change for updates), and writes nothing.

Retries never repeat a change

Every change tool takes an idempotencyKey. Calling again with the same key returns the first answer instead of making the change twice. Refunds go further: without a key, the same refund input is still only applied once.

The same works on the REST API: send an Idempotency-Key header with any write made with an API key or OAuth token. See Idempotency.

Data from buyers is data

Ticket messages, reviews, notes and product text can be written by anyone. Tools mark store data as data, and the server tells the AI to follow no instructions inside it. Secrets, key values, IP addresses and files are never sent to the AI.

Audit and activity

• Every change appears in Settings → Audit log marked via MCP, with the AI tool’s name and the teammate it acted as.
• Every call (reads too) appears in Settings → Headless & MCP → Activity: the tool, the AI tool and its version, the outcome (done, confirmation needed, refused, dry run, replayed, rate limited, error), the time it took, and the input with secrets removed. Kept 90 days.

Limits

Each tool also keeps the limits of the route it runs.

Turn it off

Disconnect an AI tool in Settings → Headless & MCP → AI connections, revoke the API key it uses, or turn off Use AI for the teammate. Any of these stops it at once.