Square vs Swell

Square

The REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026.

Swell

Live /:models schema with field types and descriptions for every store. One full-access secret key per environment, with no scoped or read-only key.

Square

1. Test against the sandbox first with the local MCP server and SANDBOX=true. The remote server at mcp.squareup.com reaches production only
2. Set DISALLOW_WRITES=true on the local MCP server when the task only reads
3. Call get_service_info, then get_type_info, before each make_api_request. The request body is otherwise untyped
4. Send a fresh idempotency_key on every write, and reuse it when retrying the same write
5. Pin Square-Version in each request. Use a page cursor within 5 minutes of receiving it

Swell

1. Call GET /:models once and cache it. It's the ground truth for custom fields
2. Check result.errors after every write. A failed validation still returns 200
3. Use $set to replace an array. A plain PUT merges arrays by element id and never shrinks them
4. Use an sk_test_ key while testing. A bare sk_ prefix is live
5. Keep expand and include small. Each level past the first three points adds rate-limit weight