LoginSign Up
← Back to all sparks
F

Foxy

E-COMM
Velocity5.0

Flexible hosted e-commerce and subscription management platform for developers.

www.foxy.io ↗

Foxy follows its legacy API lockdown with a FedEx rate-type option.

ecommercepaymentsshippingapisecurity-hygiene
◆Current state
Foxy's changelog is a steady run of small fixes across payments, shipping carriers and store settings. The past month centered on secrets handling: committed AWS credentials removed, encryption keys moved to a key provider, and restricted legacy API access for stores still on old FoxyShop store secrets. The October 14 release returns to carriers, letting FedEx return either account or list rates.
◆Where it's heading
The security pass moved from internal hygiene to changes customers notice, peaking with the legacy API restriction. With that done, work is drifting back to carrier and API options, with no new product surface.
◆Prediction
Expect more carrier and payment connector options interleaved with legacy-credential cleanup. The entries show no sign of a larger feature release.

◆Recent moves

  1. 14d ago

    FedEx shipping can return account or list rates

    Stores can now choose whether FedEx returns their negotiated account rates or published list rates. It is the first carrier feature since the security cleanup, and it changes the shipping prices customers see at checkout.

  2. 21d ago

    Legacy API restricted for stores on old FoxyShop secrets

    Stores still authenticating with legacy FoxyShop store secrets lose full access to the legacy API. This is the first step in the current security pass that changes behavior for merchants, and integrations built on old credentials will need updating.

  3. 22d ago

    Crypto: encryption keys read via app-php key provider

    Encryption keys are now read through the app-php key provider, an internal change to secret handling. It follows the earlier removal of committed AWS credentials and fits a wider security-hygiene pass.

  4. 1mo ago

    Amazon MWS HTTP/2 status line parsing fix

    A parsing fix so Amazon MWS responses over HTTP/2 are read correctly, keeping a legacy marketplace connector alive.

  5. 1mo ago

    Remove committed AWS credentials from test script

    Committed AWS credentials were removed from a test script. It is an internal security cleanup with no user-facing change.

  6. 1mo ago

    Store API: expose package weight maximum

    The store's maximum package weight is now readable and settable via the API, extending API parity for shipping configuration.