Skip to main content
Firmly can begin technical discovery with the merchant’s website URL. The remaining information helps Firmly test the integration, coordinate access, and contact the correct team if the storefront changes or becomes unavailable.

​
Information to provide

A staging environment is strongly preferred but is not required. If no staging environment is available, Firmly will coordinate production-safe validation with the technical contact.

​
Merchant actions

Most merchant integrations do not require storefront code changes. Firmly uses the merchant’s existing commerce interfaces and normalizes them into Firmly APIs and supported commerce protocols. The merchant may need to:
  1. Confirm that Firmly is authorized to access the storefront and complete integration testing.
  2. Provide test products, accounts, or payment instructions when normal public test paths are unavailable.
  3. Configure network access if existing security controls block Firmly requests.
  4. Notify Firmly before material storefront, CDN, WAF, checkout, or authentication changes.

​
Network access

Firmly supports three ways for a merchant’s security layer to recognize Firmly traffic:
  • Web Bot Auth (preferred where supported): verify Firmly’s cryptographic request signature or allow the verified FirmlyAI Bot identity.
  • Header-based allowlisting (broadly compatible): match a merchant-specific x-agentic-auth value.
  • IP allowlisting (fallback only): allow Firmly’s fixed outbound egress addresses when request-level identity is unavailable.
See Network access and allowlisting for configuration steps, IP ranges, and verification criteria.
Merchant allowlisting controls traffic from Firmly to the merchant storefront. It is separate from the credentials that destinations and partners use to call Firmly APIs.

​
Onboarding readiness

After the required information and access are available, Firmly validates the merchant’s supported commerce operations. The exact validation depends on the storefront, but typically includes catalog access and guest-cart creation, update, and cleanup. Checkout and payment validation are coordinated separately when required.