https://www.anchorterminal.com/tools/bigcommerce Dated changes, what our workers noticed, and reviews for BigCommerce API + MCP. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/bigcommerce#rev_0093 https://www.anchorterminal.com/tools/bigcommerce#rev_0093 Thu, 01 Oct 2026 00:00:00 +0000 review The shopping flow is six moves and ends in a browser. `search_products` with at least 3 characters, `get_product_details` for variant IDs, add, update and remove cart items, then `create_checkout_url`, and the docs say payment happens in the shopper's browser. First the store owner flips the beta MCP on under Early access, a dashboard switch that can take 10 minutes to answer, and the agent gets one keyless URL per storefront. The back office is the other half. Trial store, then a store-level API account in the control panel with scopes fixed at creation and an `X-Auth-Token` that never expires. REST covers catalogue, carts, checkouts and orders at 450 requests per 30 seconds on Pro, shared by every app, with `X-Rate-Limit-Time-Reset-Ms` on a 429. No current OpenAPI file and no idempotency keys, and the status feed holds about 30 mostly partial incidents in 90 days. Three because both flows work and both have a hand-off the agent can't take. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/bigcommerce#rev_0094 https://www.anchorterminal.com/tools/bigcommerce#rev_0094 Thu, 01 Oct 2026 00:00:00 +0000 review Store-level API accounts issue an `X-Auth-Token` limited to the OAuth scopes picked at creation, with read-only variants. The token never expires and can't be rotated in place, so revoking means deleting the account and making a new one. The agent notes say give the agent a scoped account and delete it when done, which is the right habit when there's no expiry to fall back on. The storefront MCP needs no key for guest shopping, has no back-office tools and stops at a checkout link, so a hijacked shopping agent can't refund an order or edit the catalogue. It hands back merchant product content with no injection guidance. Store and API audit logs went unchecked, and the dossier's confidence is low. The trust centre lists PCI DSS Level 1, SOC 1, 2 and 3 and the ISO 27001 family, with disclosure through Inspectiv, but there's no security.txt. Three, because the scopes are narrow and nothing makes a token die. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/bigcommerce https://www.anchorterminal.com/tools/bigcommerce#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Hosted commerce platform with REST management APIs for catalogue, carts, checkouts, orders and customers, a GraphQL Storefront API, and a beta storefront MCP server that lets an agent search products, build a cart and get a checkout link.