Publish forms from the API and your AI assistant
API keys and MCP connections with the new Form publishing permission can save versions and turn forms on or off, with the same checks as the builder.
Until now, the API and MCP could build a form but not ship it. An assistant could draft a whole welcome popup, and then you had to open the builder just to press Save version. If you trust the integration, it can now finish the job itself.
A new permission: Form publishing
Publishing is a separate permission, and nothing gets it unless you grant it. On an API key it's the forms:publish scope. On an MCP connection it's the Form publishing checkbox on the consent screen. Connections and keys you already have keep exactly the access they had. To add publishing to an API key, use Edit permissions on it. To add it to an MCP connection, disconnect it and connect again.
Without it, nothing changes: an assistant builds drafts, and you review and publish them yourself.
What it unlocks
- Save a version. The form's current draft is saved as a new version in its history. Pass
make_live: trueand it goes live on your storefront in the same step. By default, the storefront keeps showing what it showed before. - Turn a form on or off. Turning a form on makes its latest saved version live. If a newer version was saved without going live, turning the form on promotes it. Turning a form off takes it off the storefront and deletes nothing.
In MCP clients like Claude and ChatGPT these are the publish_form and set_form_live tools. They sit next to check_publish_readiness, so an assistant can check its own work before it ships anything.
Same checks as the builder
Publishing from the API or MCP runs the checks Save version and Turn on run in the app. The draft must be publishable, any discount it references must be valid on your plan, and any saved audience it targets must still exist. The caller's team role still applies.
Retries are safe. If the draft hasn't changed since the last version, the call returns no_changes and doesn't create a duplicate version, so a request that timed out and gets resent can't publish twice.
See MCP and the Forms API reference for details.