AtlasCore Market

Squarespace Commerce Legal addendum · Legal version v1 · Last updated: July 13, 2026

Squarespace Commerce API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with Squarespace Commerce API and developer terms for connected Squarespace stores.

Independent application status

AtlasCore is an independent software application. Squarespace and related marks are trademarks of Squarespace, Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Squarespace.

Permitted SaaS sync operations

AtlasCore accesses Squarespace Commerce APIs only after explicit merchant authorization (API key or OAuth PKCE). Permitted operations include:

- Catalog sync: product listings, variant metadata, and catalog snapshots for dashboard visibility

  • Order ingest: allowlisted order headers, line items, and fulfillment status for seller workflows
  • Inventory / fulfillment writes: only when `SQUARESPACE_WRITE_APPROVED` is enabled; inbound order webhooks do not decrement stock

Requested OAuth scopes are least-privilege:

- Read-only installs (`SQUARESPACE_WRITE_APPROVED` unset/false): `website.orders.read,website.products.read`

  • Write-approved installs (`SQUARESPACE_WRITE_APPROVED=true`): `website.orders,website.products,website.inventory`

AtlasCore does not scrape Squarespace admin interfaces or use undocumented extraction techniques.

Rate limits & API discipline

- AtlasCore respects Squarespace API rate limits and implements backoff on throttled responses

  • Sync operations are scheduled to avoid redundant polling; seller GETs are cache-only
  • Webhook events are processed idempotently via the durable `squarespace_processed_webhook_events` notification ledger

Credential security & prohibited practices

- Token encryption: API keys and OAuth access/refresh tokens are encrypted at rest (AES-256-GCM)

  • Transport: Production traffic uses TLS 1.2+ (HTTPS)
  • Tenant isolation: Each AtlasCore user links their own Squarespace store; one active `site_id` is allowed platform-wide
  • Prohibited: screen scraping, credential sharing, harvesting store data across unrelated accounts, or reselling API responses

Seller controls

- Disconnect Squarespace in AtlasCore to stop sync and purge stored credentials. Replay defense identifiers in `squarespace_processed_webhook_events` are retained in an unlinked state

See our Privacy Policy and Disconnect Marketplace guide.