Ecwid by Lightspeed vs Shopware

Ecwid by Lightspeed

The REST API has 40 access scopes, a published limit of 600 requests a minute per token with Retry-After on a 429, field selection through responseFields, and Markdown docs with an llms.txt index. Tokens never expire, there is no test mode or idempotency key, API access needs a paid plan, and carts are built only in the browser.

Shopware

MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, and 20 security advisories were published between May and September 2026, four of them critical.

Ecwid by Lightspeed

1. Send the token as Authorization: Bearer to https://app.ecwid.com/api/v3/{storeId}. Tokens in the query string stopped working in March 2025
2. Use the secret token server-side only. The public token reads enabled products and places orders that are not marked paid
3. Add responseFields, for example total,items(id,name,price), to keep responses small, and page with offset and limit (maximum 100)
4. Stay under 600 requests a minute per token and wait the Retry-After seconds on a 429. Repeated calls with a bad token get the token and IP blocked for longer
5. Work in a separate test store. There is no test mode, and POST /orders writes a real order with no idempotency key
6. After changing an app's scopes, uninstall and reinstall it, then replace the stored tokens. The old ones stop working

Shopware

1. Ask the merchant for an integration without --admin, tied to an ACL role and an MCP allowlist. Send sw-access-key and sw-secret-access-key headers to /api/_mcp
2. Call shopware-tool-search first, then shopware-toolset-enable, and keep the Mcp-Session-Id header. A fresh session lists only three tools
3. Pass dryRun=false to commit a write. shopware-media-upload has no dry run and uploads at once
4. For shopping, call the Store API over HTTP with the sales channel's sw-access-key and keep the sw-context-token. The Store API MCP endpoint has no cart tools in core
5. Send includes in search criteria to cut response size, and read the 429 body for the wait time