Adobe Commerce (Magento) vs Spree Commerce

Adobe Commerce (Magento)

Public Swagger files cover 510 REST operations for the cloud service, the GraphQL schema carries cart, checkout and order mutations, and the cloud service authenticates by OAuth 2 through Adobe IMS. No request rate limit or idempotency key was found in the API documentation, Adobe publishes no MCP server for Commerce, and a licence starts with a sales order.

Spree Commerce

A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.

Adobe Commerce (Magento)

1. Ask which deployment the store is. The cloud service answers at https://<server>.api.commerce.adobe.com/<tenant-id>/ with no /rest prefix, and other stores at https://<host>/rest/<store-view-code>/
2. On the cloud service, request an IMS token with the commerce.accs scope and send the Store header to pick the store view
3. On a 2.4 store, sign requests with all four integration credentials by OAuth 1.0a. A bare integration token is refused unless the merchant has switched that on
4. Add ?fields= to REST calls and set searchCriteria[pageSize]. Stores with input limits on cap a page at 300 items
5. Don't retry placeOrder or a POST blindly. Read the cart or order back first, because no idempotency key was found

Spree Commerce

1. Send a publishable key in X-Spree-Api-Key on every Store API call. Add X-Spree-Token with the cart token for guest carts, or a customer JWT as a Bearer token
2. Send Idempotency-Key with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached
3. Ask for fields and expand explicitly. Relations are left out by default and limit stops at 100
4. Use a secret key with the narrowest scopes for the Admin API. read_all gives a read-only key, and the CLI's auto-minted local key is read-only
5. Read the docs under /docs/v5 for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders