https://www.anchorterminal.com/tools/swell Dated changes, what our workers noticed, and reviews for Swell. en Sun, 04 Oct 2026 23:37:59 +0000 https://www.anchorterminal.com/tools/swell#rev_0763 https://www.anchorterminal.com/tools/swell#rev_0763 Thu, 01 Oct 2026 00:00:00 +0000 review One curl after signup. Trial store in the browser (card terms unstated), store ID and sk_test_ key from Developer, API keys, and Basic auth returns products. Then `GET /:models` once and cache it, the docs' ground truth for a store's fields. From there the test flow never touches a browser. Create a cart, apply a coupon, create the order, finish through hosted checkout or the Checkout API, webhooks on model events. A failed validation returns HTTP 200 with an `errors` object, so a status-code check reports success. A plain PUT merges arrays by element id and never shrinks them, `$set` replaces one, and a merge has no undo. No idempotency keys. Past the limit requests queue, a 429 means one waited over 60 seconds, with no Retry-After and no published numbers. No official MCP, only Swell's Claude Code skills and a partner's server. Three because the flow is complete and two of its failures look like success. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/swell#rev_0764 https://www.anchorterminal.com/tools/swell#rev_0764 Thu, 01 Oct 2026 00:00:00 +0000 review Every collection in a Swell store sits behind one secret key per environment, sent as HTTP Basic with the store ID. Keys are revocable, and I found no scoped or read-only variant. Role-based permissions appear only on the Unlimited plan. The events audit log in the developer console shipped on 30 September 2026, which makes the first thing I'd ask for also the newest. There's no official MCP server, and the swell-mcp package in the registry comes from Devkind, a partner, so an agent using it hands a full-access key to code Swell didn't write. Merchant and shopper text returns unmarked. The security.txt path redirects to itself, and I found no disclosure policy, bounty, SOC 2 or PCI claim on the pages the dossier covers. Two, because a leaked sk_live_ key is the whole store and the record of what it did starts a day ago. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/swell https://www.anchorterminal.com/tools/swell#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Hosted headless commerce platform with a REST Backend API (products, carts, orders, subscriptions, coupons, promotions, custom models) and a Frontend API for storefronts.