Integrations

This page explains which outside services Litestore needs and how to connect it to your other tools. It covers webhooks, API keys, MCP for AI assistants, catalog imports and self-hosting.

Litestore needs four services to run a store. Everything else is optional, and Litestore hides an optional service until you configure it.

The admin follows the same split. You connect outside platforms under Settings → Integrations. You manage API keys, webhooks and their deliveries, import runs and the self-host checks under Settings → Developer.

The four required services

PostgreSQL 15+
Redis / Upstash
S3-compatible storage
Resend

People are often surprised that Resend is on this list. Everyone signs in with a magic link sent by email, so without Resend nobody can sign in, not even you. You can't leave it until launch week, because it's how you get into the admin at all.

Outbound webhooks

You can subscribe an endpoint to store events. Litestore then sends each event to that endpoint.

Litestore signs every delivery with HMAC-SHA256. It logs each one with its status code and response body. When an integration breaks, the log shows you the exact request that failed and the exact reply.

Litestore retries a failed delivery up to five times.

If an endpoint keeps failing, Litestore switches it off:

last 15 completed deliveries all failed   →   endpoint disabled
one success in that window                →   endpoint stays alive

Litestore records the shutdown in the activity log, so you can see why the integration stopped.

Fifteen failures in a row means the endpoint is dead, not having a bad afternoon. A single success among those fifteen keeps it running, so an unreliable receiver isn't switched off for one bad patch.

You can see the full list of events you can subscribe to here:

/api/webhooks/events

Service API keys

You can issue keys for your own systems. Each key gets one or more of six scopes:

• Read
• Cart read
• Cart write
• Order write
• Webhook write
• Operator MCP

Litestore only offers scopes that something actually checks. The list is short because none of them are for show.

Litestore stores keys hashed. After you issue a key, the admin can't show it to you again.

Only a super admin can create or revoke a key, although other people can view the page. This lets someone check which keys exist without being able to create one.

MCP for AI assistants

Litestore has two MCP endpoints, and they serve very different people.

/api/mcp is public, and Litestore advertises it at /.well-known/ucp. It gives a shopper's AI assistant eight tools:

1. Store info
2. Product search
3. Product details
4. Create cart
5. Add to cart
6. View cart
7. Checkout link
8. Order status

None of these tools take payment. The checkout tool returns a link. A person opens it and pays through your normal storefront checkout, under your policies. The assistant can build a cart, but a human finishes the purchase.

/api/mcp/admin needs a key with the operator MCP scope (admin:mcp). It offers the same tools as the assistant inside the admin and checks them in the same way.

That shared check is what matters. If you disable a tool in Settings → AI, it's hidden over MCP too. Every call that changes something creates an approval card that you click in the admin. Using the remote endpoint doesn't get around the controls you set in the admin.

See MCP servers.

Platform connections

You can connect six platforms from Settings → Integrations:

• Google Ads
• Google Merchant Center
• Meta Commerce
• Shopify
• X
• Bluesky

Litestore stores each platform's credentials encrypted and records its last successful sync. The settings page warns you when a sync is out of date or has failed.

The out-of-date warning matters more than the error warning. A connection that fails tells you. A connection that quietly stopped syncing looks exactly like one that had nothing new to sync.

Catalog import

You can connect a Shopify store over OAuth and import its products, customers and collections.

Litestore records each import run. You can see the run's scope and mode, and live counts of rows imported, updated, skipped and failed. You can download an error report. Litestore also saves a checkpoint, so a stopped run can pick up where it left off.

Each imported record remembers its Shopify id. When you run the import again, Litestore updates the records the first run created instead of making copies.

Newsletter providers

You can send newsletter signups to one of seven places:

Klaviyo
Mailchimp
ConvertKit
Buttondown
Loops
Beehiiv
a plain webhook

Litestore uses the first one it finds configured. There's no priority setting to get wrong, so only configure one.

Self-hosting

You run Postgres, Redis and S3 yourself.

Settings → Developer checks the seven things a deployment needs and tells you which ones aren't responding:

1. Database
2. Redis
3. Public site URL
4. Transactional email
5. Media storage
6. Payments
7. AI provider

Open this page first when something goes wrong on a new deployment. A missing environment variable can cause a hundred different problems elsewhere, but here it shows up as one red line.

Besides the four required services, you can add these optional ones: Stripe, the Shopify import, PostHog, Plausible, GA4, Meta, the AI providers (Google, Anthropic, OpenAI) and newsletters.

The records behind it

If you read the data directly, these are the tables involved:

Webhook
WebhookDeliveryLog
ServiceApiKey
ImportRun
ImportSourceRecord
Integration          (encrypted platform credentials)

Getting started

1. Set up the four required services. Then add only the optional ones you actually use. Litestore hides an integration you haven't configured, so leaving one out costs you nothing.
2. Import your catalog if you're moving from Shopify. Connect over OAuth and read the run's error report. The skipped and failed counts show you how the migration really went.
3. Issue an API key with the narrowest scope that works, and point a webhook endpoint at the events you need.

When you choose a scope or decide which events to subscribe to, don't pick what's most convenient. Keep this in mind instead:

Grant the narrowest access that still works, because you can't read a key back, so you won't check it later. And build the receiving system so that a missed event causes a delay, not a wrong number.

Related