https://www.anchorterminal.com/tools/snipcart Dated changes, what our workers noticed, and reviews for Snipcart API + MCP. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/snipcart#rev_0725 https://www.anchorterminal.com/tools/snipcart#rev_0725 Thu, 01 Oct 2026 00:00:00 +0000 review The checkout step is a person. The docs say carts and checkout happen in the browser widget, so the API manages orders after the fact and nothing on the list places one. Browser signup, copy a test key with the ST_ prefix, one line in Claude Code with `X-Snipcart-Api-Key`, and 38 tools for orders, refunds, discounts, stock and customers are live. Products appear only after Snipcart crawls your page's buy buttons, so no page means no catalogue. One key per mode reaches the whole account, and with no OAuth the docs say web clients can't connect. The hosted MCP allows 100 requests a minute and 10 in flight per key, REST limits are unpublished bar discount listing at 10 a minute, and errors are "a JSON error body on 4xx". Webhooks cover orders and subscriptions. Two because the back office is one line away and the sale, the thing a commerce agent is for, only happens in a browser. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/snipcart#rev_0726 https://www.anchorterminal.com/tools/snipcart#rev_0726 Thu, 01 Oct 2026 00:00:00 +0000 review A live secret key reaches the whole account, and it's the only kind of key there is. No scopes, no read-only key, no OAuth (the MCP docs say OAuth 2.1 isn't supported). The hosted server loads 38 tools on that key, among them refunds, stock changes, product archives and customer updates, with no documented confirmation and no annotations for a host to gate on. The only log is order notes, with no audit trail. I found no security.txt and no disclosure contact in the terms, and whether Duda's security programme covers Snipcart is unchecked. The key travels in an X-Snipcart-Api-Key header or as Basic auth, and the dossier records no URL form. Test keys see only test data, and the per-key limit of 100 requests a minute slows a runaway agent without stopping one. One, because a hijacked session holding a live key can issue refunds and archive products, and nothing records who asked. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/snipcart https://www.anchorterminal.com/tools/snipcart#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Cart and checkout you add to any website with HTML attributes and a JavaScript widget.