Svelte Commerce on OpenCart

What works on OpenCart today

Known gaps: catalogue, search, auth, address, user, profile, coupon, page, wishlist, vendor — each is explained under Limitations below.

9 of 43 services wired, read from CONNECTORS.md on 21 September 2026, where the package version is recorded too; npm may carry a newer patch. Coverage is traced by a script in the Svelte Commerce repository: a service counts as wired only if it transitively issues an HTTP request, or delegates to one that does. It is not hand-asserted. Some services are Litekart-native concepts with no equivalent elsewhere (reels, deals, chat, gallery, popularity, demo-request, feedback, plugins, banner). They stay documented placeholders on every connector and are excluded from known gaps.

Quick start

From nothing to a Svelte Commerce storefront reading OpenCart. You need Node.js and a OpenCart to point it at; the storefront holds no data of its own.

# 1 — get the storefront
git clone https://github.com/itswadesh/svelte-commerce
cd svelte-commerce

# 2 — one connector at a time: remove the two the storefront ships with, add this one
npm uninstall @misiki/litekart-connector @misiki/vendure-connector
npm i @misiki/opencart-connector

# 3 — point it at your OpenCart store
echo PUBLIC_OPENCART_API_URL=https://your-store.example.com >> .env
echo PUBLIC_OPENCART_API_KEY=... >> .env
echo PUBLIC_OPENCART_API_SECRET=... >> .env

# 4 — run it
npm run dev

Environment variables

init.ts hands the connector every PUBLIC_OPENCART_* variable that is set, camel-cased. The guide also lists PUBLIC_OPENCART_ACCESS_KEY, PUBLIC_OPENCART_STORE_ID and PUBLIC_OPENCART_CHANNEL_ID; the connector’s source does not read them.

Every variable here begins PUBLIC_, and SvelteKit sends PUBLIC_ variables to the browser: treat each value you set as published.

What to set up on OpenCart

• Create an API user under System › Users › API in the OpenCart admin; its username and key go in PUBLIC_OPENCART_API_KEY and PUBLIC_OPENCART_API_SECRET.
• Let the storefront’s origin make cross-origin requests to OpenCart (CORS): in production the browser calls PUBLIC_OPENCART_API_URL directly, not only the server.

How the integration works

OpenCart core’s API (route=api/...) is for order management, not for a storefront catalogue. The connector wires what it can: the cart, shipping and payment addresses and methods on the API session, and shipping rates. There is no product, category or search controller to call.

api/order/info has no ownership check at all — any API caller can read any order — so the connector quarantines it behind an admin-only method that a shopper-facing call can never reach.

Installing the package is the whole switch. vite.config.ts resolves whichever @misiki/*-connector is installed, and src/lib/core/connectors/init.ts hands it every PUBLIC_OPENCART_* variable that is set, camel-cased, at boot — in the server hook for server rendering and in the client hook for the browser, which must reach the same URL in production.

There is no Litekart API behind the storefront here, so store identity — name, logo, currency, menus, plugin toggles, theme colours — comes from src/lib/core/connectors/default-store.json merged under the default export of kitcommerce.config.ts. Until you override it, the store is called “Test”. Any Litekart REST path the connector still inherits is answered from that local data, or resolved empty, rather than requested.

Limitations

• Not usable for a store yet: without the catalogue and search, there is nothing for a shopper to browse.
• No order can be placed. Placing an order (route=api/order/add) needs a customer, both addresses and shipping and payment methods on the API session, which the storefront’s checkout calls cannot supply; every way the storefront places an order is unsupported.
• Catalogue: not wired — OpenCart core has no product or category API controller, so the storefront has no products to list.
• Search: not wired — there is no search controller either.
• Sign-in (auth): throws NotSupportedError — OpenCart has no core endpoint that returns a shopper session, and a stub that signed anyone in for any password would be an auth bypass, not a placeholder.
• Saved addresses: not wired.
• User accounts: not wired.
• Profile: not wired.
• Coupons: not wired.
• CMS pages: not wired — legal and CMS pages render their layout with empty content.
• Wishlist: not wired.
• Vendors: not wired.
• Pages that depend on a service that is not wired render their empty state rather than failing.
• The API username and key come from PUBLIC_OPENCART_API_KEY and PUBLIC_OPENCART_API_SECRET. SvelteKit sends PUBLIC_ variables to the browser, so every visitor can read them and use that API user’s order-management access.
• Homepage sections other than the live product list come from the active theme’s static content — the standing rule for themes.
• The Conversational Shopping assistant is Litekart-only; its widget stays hidden when another connector is active.

Troubleshooting

Before you rely on it