Adobe Commerce (Magento) vs Ecwid by Lightspeed

Adobe Commerce (Magento)

Public Swagger files cover 510 REST operations for the cloud service, the GraphQL schema carries cart, checkout and order mutations, and the cloud service authenticates by OAuth 2 through Adobe IMS. No request rate limit or idempotency key was found in the API documentation, Adobe publishes no MCP server for Commerce, and a licence starts with a sales order.

Ecwid by Lightspeed

The REST API has 40 access scopes, a published limit of 600 requests a minute per token with Retry-After on a 429, field selection through responseFields, and Markdown docs with an llms.txt index. Tokens never expire, there is no test mode or idempotency key, API access needs a paid plan, and carts are built only in the browser.

Adobe Commerce (Magento)

1. Ask which deployment the store is. The cloud service answers at https://<server>.api.commerce.adobe.com/<tenant-id>/ with no /rest prefix, and other stores at https://<host>/rest/<store-view-code>/
2. On the cloud service, request an IMS token with the commerce.accs scope and send the Store header to pick the store view
3. On a 2.4 store, sign requests with all four integration credentials by OAuth 1.0a. A bare integration token is refused unless the merchant has switched that on
4. Add ?fields= to REST calls and set searchCriteria[pageSize]. Stores with input limits on cap a page at 300 items
5. Don't retry placeOrder or a POST blindly. Read the cart or order back first, because no idempotency key was found

Ecwid by Lightspeed

1. Send the token as Authorization: Bearer to https://app.ecwid.com/api/v3/{storeId}. Tokens in the query string stopped working in March 2025
2. Use the secret token server-side only. The public token reads enabled products and places orders that are not marked paid
3. Add responseFields, for example total,items(id,name,price), to keep responses small, and page with offset and limit (maximum 100)
4. Stay under 600 requests a minute per token and wait the Retry-After seconds on a 429. Repeated calls with a bad token get the token and IP blocked for longer
5. Work in a separate test store. There is no test mode, and POST /orders writes a real order with no idempotency key
6. After changing an app's scopes, uninstall and reinstall it, then replace the stored tokens. The old ones stop working