May 1, 2026

Rate limits and request-size guardrails on sensitive Layer endpoints

A handful of Layer's heavier API surfaces — comments, contract extraction, and the demo-data seed and reset endpoints — now enforce per-tenant rate limits and explicit request-body size caps. Bursts that previously could pile up against the LLM or seed pipeline are now rejected with a clean 429 (rate limited) or 413 (payload too large) response, instead of degrading shared throughput for everyone in the workspace.

The limits are sized for normal product use and don't affect typical dashboard or integration workflows. Programmatic consumers see standard Retry-After and X-RateLimit-Remaining headers so clients can pace themselves.

Tighter session enforcement on the dashboard

Layer's dashboard middleware now revalidates every request against the active Supabase session and tenant claim before serving it, closing edge cases where a stale or partially-rotated session could briefly resolve to the wrong workspace after a sign-out, plan change, or workspace switch. Authenticated traffic is unaffected; the only observable difference is that signed-out tabs redirect to /login immediately on the next request rather than rendering a cached shell first.

Stripe webhook processing is now idempotent up front

Stripe webhook events on Plans and billing are now claimed by event ID at the very start of the handler, before any subscription, invoice, or plan-tier write runs. A duplicate delivery from Stripe's at-least-once retry behavior — common during transient network blips or replays — is recognized and short-circuited cleanly, instead of risking a double-applied subscription update or a redundant ledger write. No action is required on your part.

One-click Slack OAuth

Connecting Slack to Layer no longer requires creating a Slack app or pasting a bot token. The connector now uses a one-click OAuth flow brokered through Auth0 — click Sign in with Slack on the integration card, approve the bot scopes on Slack's consent screen, and you're connected. The same six read-only scopes apply (users:read, users:read.email, channels:read, groups:read, team:read, apps:read), and Layer still never asks for message-content access.

Existing tenants on the legacy bot-token flow keep working unchanged — Layer transparently falls back to the previous credential field. Reconnecting through the OAuth flow upgrades the connection automatically. See the updated Slack integration guide.