Svelte Commerce on X-Cart

What works on X-Cart today

Known gaps: vendor — each is explained under Limitations below.

26 of 43 services wired, read from CONNECTORS.md on 21 September 2026, where the package version is recorded too; npm may carry a newer patch. Coverage is traced by a script in the Svelte Commerce repository: a service counts as wired only if it transitively issues an HTTP request, or delegates to one that does. It is not hand-asserted. Some services are Litekart-native concepts with no equivalent elsewhere (reels, deals, chat, gallery, popularity, demo-request, feedback, plugins, banner). They stay documented placeholders on every connector and are excluded from known gaps.

Quick start

From nothing to a Svelte Commerce storefront reading X-Cart. You need Node.js and a X-Cart to point it at; the storefront holds no data of its own.

# 1 — get the storefront
git clone https://github.com/itswadesh/svelte-commerce
cd svelte-commerce

# 2 — one connector at a time: remove the two the storefront ships with, add this one
npm uninstall @misiki/litekart-connector @misiki/vendure-connector
npm i @misiki/x-cart-connector

# 3 — point it at your X-Cart store
echo PUBLIC_X_CART_API_URL=https://your-store.example.com >> .env
echo PUBLIC_X_CART_API_KEY=... >> .env

# 4 — run it
npm run dev

Environment variables

init.ts hands the connector every PUBLIC_X_CART_* variable that is set, camel-cased. The guide also lists PUBLIC_X_CART_API_SECRET, PUBLIC_X_CART_ACCESS_KEY, PUBLIC_X_CART_STORE_ID and PUBLIC_X_CART_CHANNEL_ID; the connector’s source does not read them.

Every variable here begins PUBLIC_, and SvelteKit sends PUBLIC_ variables to the browser: treat each value you set as published.

What to set up on X-Cart

• Run X-Cart 5.5.1 or later. The connector follows the modern API; the _key query parameter of the 5.3/5.4 admin API does not exist there and is not used.
• Create the API key under Settings › API — the read/write one, because a read-only key rejects every cart and checkout write.
• Let the storefront’s origin make cross-origin requests to X-Cart (CORS): in production the browser calls PUBLIC_X_CART_API_URL directly, not only the server.

How the integration works

X-Cart 5.5.1 and later want two headers: X-Auth-Token, the store API key, on every call, and Authorization: Bearer, the shopper’s token, once they have signed in. A read-only key is enough to browse but rejects every POST, PATCH and DELETE.

Installing the package is the whole switch. vite.config.ts resolves whichever @misiki/*-connector is installed, and src/lib/core/connectors/init.ts hands it every PUBLIC_X_CART_* variable that is set, camel-cased, at boot — in the server hook for server rendering and in the client hook for the browser, which must reach the same URL in production.

There is no Litekart API behind the storefront here, so store identity — name, logo, currency, menus, plugin toggles, theme colours — comes from src/lib/core/connectors/default-store.json merged under the default export of kitcommerce.config.ts. Until you override it, the store is called “Test”. Any Litekart REST path the connector still inherits is answered from that local data, or resolved empty, rather than requested.

Limitations

• Vendors: not wired.
• Pages that depend on a service that is not wired render their empty state rather than failing.
• The store API key, sent as X-Auth-Token, comes from PUBLIC_X_CART_API_KEY — and cart and checkout need the read/write key. SvelteKit sends PUBLIC_ variables to the browser, so every visitor to the store can read it.
• Homepage sections other than the live product list come from the active theme’s static content — the standing rule for themes.
• The Conversational Shopping assistant is Litekart-only; its widget stays hidden when another connector is active.

Troubleshooting

Before you rely on it