Spree Commerce vs Wix Stores and eCommerce API

Spree Commerce

A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.

Wix Stores and eCommerce API

The developer docs are served as Markdown with an llms.txt index, and API keys carry permission scopes and a site restriction. No numeric REST rate limit or OpenAPI file was found, and status.wix.com records a platform-wide incident of 3 hours 17 minutes on 1 August 2026. A person must create the account and the key.

Spree Commerce

1. Send a publishable key in X-Spree-Api-Key on every Store API call. Add X-Spree-Token with the cart token for guest carts, or a customer JWT as a Bearer token
2. Send Idempotency-Key with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached
3. Ask for fields and expand explicitly. Relations are left out by default and limit stops at 100
4. Use a secret key with the narrowest scopes for the Admin API. read_all gives a read-only key, and the CLI's auto-minted local key is read-only
5. Read the docs under /docs/v5 for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders

Wix Stores and eCommerce API

1. Send the API key in Authorization with wix-site-id for site calls or wix-account-id for account calls, never both
2. Fetch the product first and pass product.revision on every Catalogue V3 update, or the call fails with 409
3. Use Cart V2 for new work. The older eCommerce Cart and Checkout APIs were deprecated on 5 August 2026
4. Request cursorPaging.limit of at most 100 on Query Products and use Search Products for lookups by name
5. Over MCP, read the method page with ReadFullDocsArticle before CallWixSiteAPI. Responses are cut at 50,000 characters by default