> ## Documentation Index
> Fetch the complete documentation index at: https://developers.firmly.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Merchant onboarding requirements

> Information and merchant actions required to onboard a storefront with Firmly.

Firmly can begin technical discovery with the merchant's website URL. The remaining information helps Firmly test the integration, coordinate access, and contact the correct team if the storefront changes or becomes unavailable.

## Information to provide

| Requirement           | Required    | Purpose                                                                                                                    |
| --------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Website URL**       | Yes         | Identifies the production storefront that Firmly will integrate and validate.                                              |
| **Technical contact** | Yes         | Provide a name, email address, and phone number for integration questions, access issues, outages, and production changes. |
| **Staging URL**       | Preferred   | Enables integration and order-flow testing without affecting the production storefront.                                    |
| **Network access**    | Conditional | Required only when a CDN, WAF, bot-management system, or rate limiter blocks Firmly traffic.                               |

<Info>
  A staging environment is strongly preferred but is not required. If no staging environment is available, Firmly will coordinate production-safe validation with the technical contact.
</Info>

## Merchant actions

Most merchant integrations do not require storefront code changes. Firmly uses the merchant's existing commerce interfaces and normalizes them into Firmly APIs and supported commerce protocols.

The merchant may need to:

1. Confirm that Firmly is authorized to access the storefront and complete integration testing.
2. Provide test products, accounts, or payment instructions when normal public test paths are unavailable.
3. Configure network access if existing security controls block Firmly requests.
4. Notify Firmly before material storefront, CDN, WAF, checkout, or authentication changes.

## Network access

Firmly supports three ways for a merchant's security layer to recognize Firmly traffic:

* **Web Bot Auth (preferred where supported):** verify Firmly's cryptographic request signature or allow the verified FirmlyAI Bot identity.
* **Header-based allowlisting (broadly compatible):** match a merchant-specific `x-agentic-auth` value.
* **IP allowlisting (fallback only):** allow Firmly's fixed outbound egress addresses when request-level identity is unavailable.

See [Network access and allowlisting](/firmly-connect/merchant-onboarding/network-access) for configuration steps, IP ranges, and verification criteria.

<Note>
  Merchant allowlisting controls traffic from Firmly to the merchant storefront. It is separate from the credentials that destinations and partners use to call Firmly APIs.
</Note>

## Onboarding readiness

After the required information and access are available, Firmly validates the merchant's supported commerce operations. The exact validation depends on the storefront, but typically includes catalog access and guest-cart creation, update, and cleanup. Checkout and payment validation are coordinated separately when required.