Integration settings

One page per outside system, all of them System Manager only. Every one of these forms holds credentials, so treat the page like the keys to the store.

Never read a secret back out

API keys, passwords and webhook secrets are stored encrypted and are meant to be written once. Do not copy them into a message, a ticket or a document. If a credential is wrong, replace it rather than reading it.

Each section below names the route, what the page connects to, the fields an operator actually touches, which buttons test it, and where the status and last-error fields live.

FastBound Settings

/app/fastbound-settings. Connects to FastBound, the electronic bound book and the place 4473s are completed. See FastBound.

Three tabs: Connection, Status, Advanced.

Connection tab. Enable FastBound is the master switch. Turn it off and A&D records are kept locally only, and firearm sales then need Paper 4473 Mode in FFL Settings, with open tills reloaded. Account number is the FastBound account. API key is the credential. Base URL is https://cloud.fastbound.com in production, and a blank value stops the integration. Audit user is the identity sent with every call, so FastBound's own audit trail can attribute what we did.

Webhook section. Webhook secret comes from FastBound's own Settings then Webhooks page. The form prints the webhook URL to register there.

Status tab. Last import, Items imported and Import errors record the last bound-book import. Acquisition types, Disposition types and Lists synced at are the cached FastBound pick lists, refreshed by the button below.

Advanced tab. Look up FFL on push is on by default and should stay on outside a test account. Request Timeout (s) defaults to 30.

Buttons. Test Connection on the toolbar. Under a FastBound menu: Sync FastBound Lists refreshes the cached types, and Import Bound Book pulls items in.

Payroc Settings

/app/payroc-settings. Connects to the Payroc card gateway and the physical terminal at the counter. See Taking payment.

Credentials, Advanced and Status.

Credentials. Enable Payroc Terminal Integration is the master switch. Untick it to run without the integrated terminal, in which case cards are swiped on a standalone terminal and the register records the Credit Card tender as plain tender. Require Card Reference (manual terminal) applies only in that standalone mode and is on by default: a card sale or refund cannot complete until the terminal's approval code is typed in. Merchant API Key is the credential. Gateway Terminal Number is the gateway's terminal number, which is not the same thing as the device serial. Device Serial Number is the physical terminal's serial and goes in the request path. Leave it blank and card payments stay disabled, and a charge attempt errors out. Fill it in only after the terminal is paired. Default Currency is USD. X-Integration-ID (ISV only) is needed only when the merchant key sits under a software vendor's integration, and stays blank for a plain merchant key.

Advanced. Sandbox Mode points the calls at the Payroc test host. Untick it for production. Base URL Override and Request Timeout (seconds) are there for unusual setups.

Status. Last Token Refreshed At and Last Charge At are read-only.

Buttons. This form has no toolbar test. Test the processor from the Payments hub at /app/payment-hub, where each processor card carries a Test Connection button, an Enabled toggle and a Credentials button that opens this form.

RSR Settings

/app/rsr-settings. Connects to RSR Group two ways at once: a file feed over FTPS for the catalog, and a separate ordering interface. See Distributors.

FTP connection, paths, ordering interface, automation and status.

FTP Connection. FTP Host defaults to RSR's server and Port to 2222 for explicit FTPS. Key Dealer switches which directory and file are downloaded. FTP Username and FTP Password are the feed credentials.

Paths. Seven fields: the default and key-dealer directories, and the five filenames for the catalog, quantity, deleted-products, attributes and ship-restrictions files. Change them only when RSR changes them.

Direct Connect API. Enable Direct Connect API is the master switch for ordering, off by default, and the client refuses every call while it is off. API Base URL and POS Indicator identify us. Order Email is the shop's own email, never a customer's or a transfer dealer's, and order placement fails closed while it is blank. There are two separate credential pairs: Dealer Account # with Dealer API Password for stocking and restock orders, and Fulfillment Account # with Fulfillment API Password for drop-ship.

Automation. Enable Scheduled Auto-Sync is the master switch for the scheduled syncs; the manual buttons work either way. Catalog Sync Frequency defaults to Daily, Quantity Sync Frequency to Hourly, and Ship Restrictions Sync Frequency to Every 2 Hours.

Status. Six read-only fields record the last catalog, quantity and restrictions sync with their row counts, plus a restrictions batch marker and a catalog change cursor. Last Sync Error in its own section is the field to read when something looks stale.

Buttons. Under an RSR menu on the toolbar: Test Connection, Sync Quantities Now and Sync Catalog Now. The Distributors hub also exposes a Test Connection per distributor.

ShipStation Settings

/app/shipstation-settings. Connects to ShipStation for outbound labels and tracking. See Consignment shipping and The Pending Order queue.

Status, credentials and shipping defaults.

Status. Enabled is the master switch for the Pending Order page's Ship button. Leave it off until the credentials pass Test Connection. Sandbox Mode points at the test host.

Credentials. API Key is the ShipStation V2 key, stored encrypted. Sandbox keys start with TEST_. Base URL Override defaults to the V2 endpoint. Request Timeout (s) defaults to 30.

Shipping Defaults. Store ID is the ShipStation store orders are created under. Ship-From Warehouse ID is the store's origin address on their side. Default Parcel Weight (oz) is the fallback when an item carries no weight, 16 ounces by default.

Buttons. Test Connection under a ShipStation menu on the toolbar. This form has no last-error field. Failures land in the error log and in the alert email.

GunBroker Settings

/app/gunbroker-settings. Connects to the GunBroker marketplace for listings and orders. See GunBroker.

Four tabs: Connection, Listings, Accounting and Advanced. Status is a section on the Connection tab.

Connection. Enable GunBroker is the master switch and is off by default, so nothing is sent or read while it is off. Sandbox mode is on by default and points at GunBroker's sandbox; untick it for the live marketplace. Seller username and Seller password are the account credentials.

Status section. Last listing push, Listings pushed, Last sweep, Orders synced up to (UTC), Orders synced and Last error are all read-only. Read Last error first when listings or orders stop moving.

Listings tab. Listing defaults used when a gun is sent up: Ship-from ZIP, Country, Duration (days, fixed price), Auto-relist (fixed price), Inspection period, FFL required, Ships internationally, Photos per listing, and either the account's own excluded states or an explicit Excluded states list. Auction defaults sit below: Listing type offered, Auction length (days) and Auto-relist (auction). Shipping defaults set who pays and the three fallback rates for long guns, handguns and accessories, used when a listing carries no rate of its own. A long-gun rate of zero makes the system refuse the listing. Payment methods are individual tick boxes. Personal check and card checkout are both off by default. The Category map table maps firearm type, item group or antique status to a GunBroker category, and an item's own category id overrides it. Listing content holds Blocked title phrases, one per line, and a Description footer appended to every listing, whose links and images must be secure.

Accounting tab. Check deposit account must be the operating bank account, not a clearing account. Card clearing account, FFL doc fee (per item) and the Final value fee tiers table complete the fee model. See Month-end close.

Advanced tab. Scheduled sync switches the order poll and listing sweeps on. Auto-acknowledge orders, Paid-not-shipped alert (days) at 7, End listings via and a one-time Re-read orders since back-fill. The API section holds request timeout, the counter check budget, page size and a base URL override for testing.

Buttons. Test Connection on the toolbar, and Fetch Listing Defaults to pull the account's own listing settings down.

WooCommerce Settings

/app/woocommerce-settings. Connects to the retail online store. See WooCommerce.

Connection, Sync and Status tabs.

Connection tab. Store URL must be secure and carry no trailing slash. Consumer key and Consumer secret come from the store's own Settings, Advanced, REST API page. Webhook secret comes from Settings, Advanced, Webhooks on the same store.

Sync tab. Enable sync is the master switch, off by default, and while it is off nothing is pushed, reconciled or audited. Reconcile frequency offers Every 2 Hours, Daily, Weekly or Disabled, and defaults to Daily. Request Timeout (s) defaults to 30.

Status tab. Last push, Items pushed, Last reconcile, Last order audit and Last error are read-only. Last order audit is the daily check for store orders missing from the system.

Buttons. Test Connection on the toolbar reads one product from the store with the saved credentials and writes nothing. Press it after every change here. Push, delist and reconcile are driven from the Item and Serial No forms and from the scheduled jobs. When something is wrong, read Last error on the Status tab.

Dealer WooCommerce Settings

/app/dealer-woocommerce-settings. Connects to the second, wholesale storefront that business dealers buy from. See Dealer portal.

The form is identical to WooCommerce Settings above, field for field: the same Connection, Sync and Status tabs, the same store URL, consumer key, consumer secret and webhook secret, the same enable switch and reconcile frequency, and the same five read-only status fields.

Two things differ in practice. This store is also gated by the Dealer Portal switch in FFL Settings, which hides the Send to Dealer Portal and Delist from Dealer Portal buttons when it is off. And an item has to have Publish to Dealer Portal ticked before it can be sent, or the system refuses with a message telling you to tick it.