Ecwid by Lightspeed vs Square

Ecwid by Lightspeed

The REST API has 40 access scopes, a published limit of 600 requests a minute per token with Retry-After on a 429, field selection through responseFields, and Markdown docs with an llms.txt index. Tokens never expire, there is no test mode or idempotency key, API access needs a paid plan, and carts are built only in the browser.

Square

The REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026.

Ecwid by Lightspeed

1. Send the token as Authorization: Bearer to https://app.ecwid.com/api/v3/{storeId}. Tokens in the query string stopped working in March 2025
2. Use the secret token server-side only. The public token reads enabled products and places orders that are not marked paid
3. Add responseFields, for example total,items(id,name,price), to keep responses small, and page with offset and limit (maximum 100)
4. Stay under 600 requests a minute per token and wait the Retry-After seconds on a 429. Repeated calls with a bad token get the token and IP blocked for longer
5. Work in a separate test store. There is no test mode, and POST /orders writes a real order with no idempotency key
6. After changing an app's scopes, uninstall and reinstall it, then replace the stored tokens. The old ones stop working

Square

1. Test against the sandbox first with the local MCP server and SANDBOX=true. The remote server at mcp.squareup.com reaches production only
2. Set DISALLOW_WRITES=true on the local MCP server when the task only reads
3. Call get_service_info, then get_type_info, before each make_api_request. The request body is otherwise untyped
4. Send a fresh idempotency_key on every write, and reuse it when retrying the same write
5. Pin Square-Version in each request. Use a page cursor within 5 minutes of receiving it