> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

## Catalyst Core Updates: Private Tokens and the GraphQL Proxy

Updates to the Catalyst Core course document how Catalyst authenticates GraphQL requests with private storefront tokens and how it proxies client-side requests.

* **Set Up a Catalyst Project lab** — clarifies that `BIGCOMMERCE_STOREFRONT_TOKEN` is a private GraphQL Storefront API token and links to the Create Private Token endpoint
* **Environment variables** — adds `BIGCOMMERCE_STOREFRONT_UNAUTHENTICATED_TOKEN`, the private token limited to the "Unauthenticated" scope used to proxy client-side GraphQL requests
* **The API Client lesson** — adds a GraphQL Proxy section explaining how Catalyst proxies browser `POST /graphql` requests to BigCommerce without exposing a storefront token

For details, see the [Catalyst Core course](/developer/learn/courses/catalyst-core).