Configuration

This page lists every KahunaCart config key, its default, and what it does. Set them in user/config/plugins/kahunacart.yaml.

Most keys also have a field on the admin's Settings screen, which is part of the KahunaCart page since 1.2.0. Keys marked YAML-only have no admin field. See Orders and the admin → Settings, on this page.

Clear the route cache after a plugin update

The API plugin caches its route table on disk under cache://api/. Installing, enabling, disabling or removing a plugin clears that cache. Updating a plugin that is already enabled does not, so its new API endpoints return 404 while the admin screens look installed.

After updating KahunaCart or any provider plugin, clear the cache:

bin/grav clear-cache

To drop only the route table, delete the directory:

rm -rf cache/api

Environment variables

Every key on this page accepts Grav's environment-variable form. A value of $MY_VAR or ${MY_VAR} is replaced with that variable from the server's environment when the configuration loads. Use it for anything that should not sit in a committed file: a provider's API key, a database password, the signing secret of a notification channel.

database:
  type: mysql
  password: $KAHUNACART_DATABASE_PASSWORD
checkout:
  address_validation:
    api_key: $MAPBOX_TOKEN

Set the variable in the web server's or PHP-FPM's environment (env[KAHUNACART_DATABASE_PASSWORD] in a pool file, SetEnv in Apache) and in the shell the scheduler runs from, or bin/plugin kahunacart work reads an empty value. A variable that is not set resolves to an empty string, not to the literal $NAME, so it behaves like an empty setting. Provider plugins read their settings through the same loader, so their keys take the form too.

The name to use

Any variable name works. The convention below is the one bin/plugin kahunacart config:export writes, so an export drops into another store and reads the right variables without editing:

$KAHUNACART_ followed by the key in upper case, with every run of non-alphanumeric characters replaced by a single underscore.

Which settings the exporter treats as secret

config:export never writes a secret’s value. The store signing secret, UCP signing keys and sign-in nonces are omitted. Import preserves the target store’s credentials and ignores credential values in older files. Notification webhook URLs and Google’s order webhook URL leave as environment references. A config key counts as secret when its full dotted name contains any of these words:

api_key, secret, password, token, private_key, credential, webhook_secret, passphrase

Those come out as $KAHUNACART_… references. Everything else comes out as its value. The rule reads the key's name, not a list of known keys, so a provider plugin's own stripe.api_key is covered too.

See CLI for the export and import commands.

Store

Store status

One setting opens the store, announces it, or pauses it, so you never have to switch the cart, the theme's cart link, express pay and the agent channels off one by one. Change it under Store status on the General tab of KahunaCart's settings, with the switch at the top of the store dashboard, with bin/plugin kahunacart store --status=paused, or through the admin API (GET and POST /kahunacart/store/status, and the MCP tools get_store_status and set_store_status).

• Open (open) takes orders as normal.
• Coming soon (coming_soon) is for a store that hasn't launched. Nobody but staff can buy, and search engines are asked to leave the storefront out: every storefront page carries noindex (a robots meta tag and an X-Robots-Tag header), its products drop out of the sitemap, and the Google and OpenAI product feeds answer 404.
• Paused (paused) is for a store that is closed for a while: a move to another site, a stock-take, a holiday. Nobody but staff can buy, and nothing about indexing changes, so a short pause doesn't cost the store its search rankings or its merchant centre listings.

While the store is coming soon or paused:

• Every page shows a banner with your message, the site's other pages included. The plugin puts it straight after <body>, or your theme places it itself. See Theming → The store status.
• Buying is off everywhere. The cart and checkout pages, adding to the cart, buy-now, moving a wishlist into the cart, the restore page a recovery or share link opens, express pay, the storefront JSON API's cart and checkout, the storefront MCP's cart and checkout tools, and UCP checkout all refuse with your message. The cart and checkout pages answer 503 with Retry-After: 3600, so search engines read it as "come back later". Moving a wishlist into the cart is refused with a message on the wishlist page. Reading the cart through the JSON API and cancelling an open payment still work. The JSON API, MCP and UCP answer a store_closed error. Product pages still show, with Coming soon or Paused where the buy button was.
• Everything else keeps working: browsing and search, customer sign-in and account pages (a wishlist can still be kept, shared and edited), order and receipt pages, downloads already bought, invoices, pay links for a balance or a deposit on an existing order, accepting a quote, provider webhooks, the job worker, subscription renewals, and the whole admin. Paying for an order that already exists isn't buying.
• Staff can still buy. A signed-in admin with KahunaCart permissions (kahunacart.orders.view, kahunacart.settings, or a super admin) sees the store working, with a banner saying "Your store is paused. Only staff can buy." and what shoppers are told. That is how you place a test order before you open. An agent, UCP, or an API client with a token-bound cart never gets the staff view. A storefront JSON API request made with a signed-in staff session can still buy.
• You won't forget to reopen. The dashboard shows the status in the warning colour, and bin/plugin kahunacart check warns about it every time it runs. See Going live → Store status.
• Nothing closed sits in a cache. Every page that would otherwise be cached, in the shop and on the rest of the site, goes out as Cache-Control: private, no-cache, max-age=0, while the cart, checkout, receipt and account pages keep their private, no-store, so no CDN or proxy keeps a copy and a browser asks again before showing one. An open store keeps the caching it always had.

Every change clears Grav's cache, the same as saving the settings in the admin, so the next request reads the new status. A page a browser or a CDN kept from while the store was open can still show a buy button until its max-age runs out (a week with Grav's default system.pages.expires). That does no harm, because the cart and checkout refuse the purchase whatever the page shows. If a CDN sits in front of the shop, purge it after you change the status.

Changing the status fires onKahunaCartStoreStatusChanged with from, to, message and by. Changing only the message fires nothing. The owner notifications don't include it, because the person who changes the status is the person who would be told.

The status belongs to each site. A store bundle and config:export never carry it, and a restore or config:import never writes it, so a store paused for its move doesn't arrive paused, and a new store paused for its test order isn't opened by the restore. See Export and restore → Moving your shop to its own site.

cart.enabled: false is a different thing. It removes the basket from a store that only shows a catalogue, with no banner and no way in for staff. A paused store keeps its cart, ready for the day it opens.

Currencies

The currency key above is the base currency. The currencies block lists any extra currencies the store sells in and how a visitor's currency is chosen. Leave it alone and the store is single-currency, exactly as before. How it all works is on Currencies.

A currency set to convert also converts a missing entry in a config map from the base entry (or from a plain base amount), and an entry you typed still wins. Save pricing on the Currencies screen to queue the index update. After changing it directly in YAML, run bin/plugin kahunacart index --rebuild.

shipping.flat_rate, cart.order_min_total and cart.order_max_total take a plain base-currency amount or a map of currency to amount. On a store that sells in more than one currency, Configuration has one box per currency for each of the three. A store with one currency keeps a single box. With typed pricing, a missing amount is never filled from the base. A currency set to convert fills it in. Return fees and shipping policy amounts also accept maps. See Currencies → Amounts in the config file.

Product images and media

Product images live in user/images/kahunacart/products/{productId}, which the web server serves directly. Video, audio and PDF samples share that directory. KahunaCart reads an upload's format from the file, never from its extension.

All four keys are on the General tab of the plugin settings, under Product Media.

Storefront SEO

These apply to product and category pages only.

Four more seo.* keys add the structured data agents and shopping search read. They only take effect while agentic.enabled is on; see Agentic commerce.

See Storefront → Search engines for what each block contains.

Catalog

These eight keys decide how the shop page, category pages and search present the catalog. All eight are on the General tab of the plugin settings, under Catalog Order. The catalog index and the merchandising blocks have their own subsections below.

The catalog index

The catalog index is one row per purchasable unit behind every listing, facet count, sort and search. See The catalog index.

An index that has never been built is never joined, whatever these are set to. Run bin/plugin kahunacart index --rebuild once after updating. See CLI.

Related products, cross-sells and up-sells

Product revisions and scheduling

See Product lifecycle for what a revision holds and how a queued change is applied.

Storefront search

Choose the search engine

search.products.driver is a ladder of four values, and auto takes the highest rung this installation can run.

auto falls down the ladder instead of failing: yetisearch on a PHP build with no FTS5 lands on sql, then on like. A store pinned to like keeps its search pages on the live queries even when the catalog index is joined for every other listing. See Storefront.

Rank search results and apply synonyms

Semantic search

Off by default. Switch it on and the ranked index finds products by meaning as well as keywords, so hat finds the cap and the beanie. It needs the yetisearch engine and an embedding provider, and it sends product text and search terms to that provider. Most stores set enabled and api_key and leave the rest alone. See Storefront → Semantic search.

Keys shown with a default in brackets ship empty. An empty key takes YetiSearch Pro's value when that plugin has its own semantic search on, and the bracketed default otherwise.

Tax

The flat rate below is a fallback. As soon as one tax zone exists, the zone engine takes over, and tax.rate, tax.apply_to_shipping and tax.label stop being read. See Tax.

tax.included is the bottom of a four-level order: the product's own price_includes_tax wins, then a region price preference, then a currency one, then this key. See Tax.

Shipping

The flat rate applies until the first shipping zone exists. See Shipping.

Sales

Automatic scheduled discounts. A store with no sales renders the storefront it always did. See Sales.

Price lists and quantity tiers

A price list is a named set of prices for the shoppers its rules name. A quantity tier is a price that depends on how many are being bought. See Price lists and quantity tiers.

Coupons

Discount codes the customer types in, or arrives holding from a link such as /shop?coupon=EARLY50. See Coupons.

Stock

Cart

A cart qualifies for a reminder only if it has an email address on it. In practice that means the customer submitted the checkout form and then did not pay.

Order rules

Four keys say what the whole basket has to be, whatever it is made of. All four are off as the plugin ships.

The two value rules measure the merchandise subtotal after discounts, before shipping and tax. A shopper cannot reach a minimum by paying for postage, and a store that adds tax at the last step does not enforce a £50 minimum at £41.67.

A basket outside any of the four prints the reason at the top of the cart page, and the checkout button stays where it was. A shopper who walks past it is refused at checkout with the same sentence, and POST {route}/api/checkout refuses with it under code: "validation".

Set Exclude from order rules on a product and its lines count for nothing in any of the four, neither their units nor their money. Use it for gift cards, donations, deposits and shipping protection. A basket holding nothing but excluded lines is refused nothing at all. See Order rules.

Emails

Every email renders from templates/emails/*.twig and can be overridden in your theme like any other Grav template. The emails.* keys are on the Notifications tab of the plugin settings, under Customer Emails. See Emails.

Email branding

Four fields repaint every email without editing a template. Set them under Notifications → Customer Emails, or in the YAML.

emails:
  brand:
    color: '#2f6f4f'
    button_color: '#2f6f4f'
    logo: '/user/images/logo.png'
    logo_width: 160

Nothing here is validated beyond trimming whitespace, and changes take effect after a cache clear. For anything past a repaint, override the template. See Emails.

Checkout

Deposits

Taking part of the money up front and the rest later. See Deposits.

Address validation

Optional delivery-address checking through a third-party geocoder, billed to your own account with that provider. It stays off until you set both a provider and a key. See Address validation.

Express pay

The wallet-button region on the cart and checkout pages, where Apple Pay, Google Pay, Link or PayPal Express draw their buttons. KahunaCart ships the region and the button style; the button itself belongs to the provider, and no card data ever reaches KahunaCart. Nothing appears until a provider that draws one is installed. See Provider contract.

A value outside its range is clamped, not refused. The wrapper carries all four as --kahunacart-express-* custom properties for the theme. See Theming.

Order notices

These settings control notices about order changes, such as a discount code that expired between add-to-cart and checkout, an item that can no longer be purchased, or a price change. See Storefront for what a customer sees, and Orders and the admin for the merchant's half.

Customer accounts

The account area needs the Login plugin, which owns the sign-in form, forgot password, magic links, two-factor, and remember-me. KahunaCart never authenticates anybody itself and never writes to a user account YAML. account.db_identity decides only where a customer's credentials are kept. See Customer accounts.

Sign-in links

A one-time link emailed to a customer who would rather not remember a password. All three keys need account.db_identity. See Customer accounts.

Clicking a link is counted separately, by security.rate_limits.magic_link_consume.

Customer groups

A group is a named set of customers a pricing rule, a coupon condition, a shipping rule or a member-only product can point at. Groups themselves are rows, created in the admin or over the API. See Customer groups.

One key decides how a Grav account's own user groups reach its customer record.

customers:
  group_map:
    - grav_group: members
      customer_group: members
    - grav_group: staff
      customer_group: staff

A code this store does not have is logged and ignored rather than created. See Map a Grav user group to a customer group.

Articles with a teaser

A page marked paywall: <group> is open to everyone, and a visitor who doesn't hold the group sees the part above the === line and a subscribe panel. These are the store-wide settings. Each page can override the teaser length and the subscribe link. In Admin Next they're under Settings → Accounts → Articles with a teaser. See Customer accounts → Articles with a teaser.

Wishlists

An anonymous list is addressed by a cookie named kahunacart_wishlist (HttpOnly, SameSite=Lax, one year) and is merged into the account when its owner signs in. See Wishlists.

Reviews and ratings

The verified-purchase badge has no config key and no API field. It is computed from the customer's own paid orders, and recomputed when a review is approved. See Reviews and ratings.

Cart recovery

A signed restore link in the abandoned-cart email, one follow-up reminder, and a share link a merchant sends for a phone or social sale. recovery accepts false in place of its block. See Cart recovery.

The retention schedule

Four windows, all off by default, so upgrading a live store deletes nothing by surprise. Each is a number plus a unit, and the unit is one of days, weeks, months or years. A month is 30 days and a year is 365. A window of 0, a negative number, a non-number or an unrecognised unit all read as off.

Trashing means archiving; the two trash rules delete nothing. Completed orders are anonymised, not deleted, so revenue, tax and product reports return the same numbers afterwards. Run bin/plugin kahunacart retention:run --dry-run before switching any window on. See The retention schedule.

The payment reference

Invoices

Invoices print at {route}/order/{hash}/invoice and download as a PDF from {route}/order/{hash}/invoice.pdf. Both render the same document. The first five keys are on the Accounts tab, under Invoices.

Invoice numbering

An invoice number comes from its own counter, separate from the order number, and is allocated when an order completes. In much of Europe it has to be sequential, gapless and carry the year. These three keys are on the Accounts tab, under Invoice Numbering.

The format takes three placeholders and leaves everything else exactly as written.

INV-{year}-{number:5} prints INV-2026-00042.

Store credit and gift cards

One append-only ledger per customer, with the balance summed from it and never stored. Gift cards are built on that ledger. See Store credit, gift cards and credit notes.

Credit notes

A credit note is issued automatically whenever a refund is confirmed, and is numbered from its own book, not the invoice's.

Offline payments

All three keys are on the plugin settings page, under Commerce → Offline Payment. A store using payment methods merchandises the offline gateway there instead, and a method's own label and instructions win where there are any.

Digital delivery

See Digital products for the full picture, including the nginx and Apache configuration the non-PHP delivery methods need.

default_limit and default_expiry_days read as unset when empty, non-numeric, or zero or below. Clearing the admin field means unlimited or never, not zero.

Run bin/plugin kahunacart downloads:check to list every product file that can no longer be delivered.

Order links

The receipt, invoice, invoice PDF and pay pages are each reached by a signed link that expires. A customer whose link has run out gets a page offering to email a fresh one to the address on the order. All three keys are on the Security tab, under Order Links. See Hardening.

The key the links are signed with is not a config setting. KahunaCart creates it from 32 random bytes and stores it under security.secret in kahunacart_settings. An empty key or one shorter than 32 characters is repaired under a lock before signing. If it cannot be stored, signing stops. Configuration export omits it and import never replaces it. Deleting that row rotates it and invalidates links the store has already emailed.

Rate limits

Every route a visitor can hammer is counted per client address in a named bucket. Each bucket is two keys, a limit and a window in seconds, and both are settable on their own. A limit of 0 turns that bucket off. YAML-only. See Hardening.

The agent buckets are counted per address, except that a UCP request that has authenticated (a valid API key or a verified signature) is counted per platform and session, because platforms call from a few shared addresses. See Hardening → Agent endpoints.

security:
  rate_limits:
    checkout: { limit: 5, window: 60 }
    download: { limit: 0, window: 60 }

A limited request answers 429 with a Retry-After header and is logged at info level. Counts live in kahunacart_rate_limits in the store's own database, so every worker and every node counts against the same rows.

Site address

system.custom_base_url, when set, is used instead of all of them. With both empty, sign-in, set-password and cart links are not sent. While both are empty, security.site_urls is filled in with the address an administrator is using the first time they open the admin dashboard or KahunaCart's admin page, or save KahunaCart's settings, as long as that is an HTTPS address and not a development one. See Hardening → Site address for emailed links.

Trusted proxies

Empty means the header is ignored and REMOTE_ADDR is the client, which is correct for a store nothing sits in front of.

Demo store

Both are on the Database tab of the plugin settings, under Demo Store. See Demo store for what it locks, what it leaves open, and how to reset a public demo on a timer.

Storefront JSON API

Every endpoint, status code and error code is in Storefront JSON API.

Agentic commerce

The settings behind structured data, the product feeds, the storefront MCP endpoint and UCP, all on the Agentic Commerce tab. Everything that answers a request is off as shipped. See Agentic commerce for what each part does and the setup checklist.

The master switch

Seller

Store policies

Every URL may be site-relative (/terms) and is published absolute. A link that is not http or https is dropped.

Feeds, the MCP endpoint and UCP

ucp.google.api_key and ucp.google.order_webhook_url are stored encrypted when saved from the admin, like a provider's secret. See UCP checkout for what each key changes.

Merchant notifications

Outbound notifications to Slack, Discord, or an endpoint of your own. No channel is configured by default. See Notifications for payload details and the signing contract.

Each entry in notifications.channels takes these keys.

Outbound webhooks

Subscriptions an integrator registers to be told when something happens here. Distinct from the merchant notification channels above and from the inbound webhooks a payment provider sends you. See Outbound webhooks.

The job queue

Cron's floor is a minute, so a confirmation email queued a second after the tick waits fifty-nine seconds for nothing but the clock. These keys govern the two ways of closing that gap and the deadline every job runs under. See CLI.

Webhook log and job warnings

Catalog sync

YAML-only. The keys are provider slugs, so there is no admin field for them. See Sync.

sync:
  polar:
    direction: remote

Direction governs automatic work only. A manual bin/plugin kahunacart sync --push --provider=<slug> or --pull --provider=<slug> always does what you asked.

Bulk edits, imports and exports

These govern the bulk editor, the CSV importer and store bundles. See Importing for the CSV importer, Export and restore for store bundles, and Products and catalog for the bulk editor.

Database

SQLite

The zero-configuration default. KahunaCart creates the directory, writes deny-all protection files into it, chmods the database file to 0640, and opens it with journal_mode=WAL, foreign_keys=ON, busy_timeout=5000, synchronous=NORMAL, and temp_store=MEMORY.

MySQL / MariaDB

KahunaCart connects with charset=utf8mb4 and expects the server to run in strict mode. bin/plugin kahunacart status warns you when it does not, because a non-strict MySQL truncates data silently instead of refusing it.

PostgreSQL

A standard connection. There is nothing extra to configure.

Named connections

Set database.type to connection to hand connection management to the Database plugin. Put the connection name in database.connection:

database:
  type: connection
  connection: commerce

KahunaCart pulls the PDO handle from that connection and wraps it in the matching dialect. Two errors are possible:

• database.type is "connection" but database.connection is empty — set database.connection.
• named connections require the "database" plugin — install the Database plugin.

The auto_migrate policy

When auto-migration is active, the check runs on every non-admin frontend request and on every KahunaCart admin API request. It is a single "is anything pending" query, and it applies migrations only when something is.

Bulk actions and order exports

See Bulk actions on orders and Export orders with your own columns.

Reporting

What a report covers when it opens, what it compares against, and which day an order belongs to. See Analytics.

reports.attribution.enabled ships on and is the one key here that records something about visitors. Nothing is stored about a visitor who does not order, and nothing external is contacted: no beacon, no pixel, no outbound request. The user agent is read once for a desktop, mobile, tablet or bot bucket and never stored. Set it to false to stop the capture; orders already captured keep what they have.

Dashboard alerts

The strip at the top of the store admin. See Dashboard alerts.

The extension platform

Settings that are not config keys

Which emails go out, which template pair each renders from, and the operator-editable formats (SKU, line titles, the order reference and description, the invoice file name and every email subject) are not YAML keys. They are store data, edited on the Notifications and Object templates screens in the admin or through their API routes, and kept in kahunacart_settings. See Emails and Object templates.

Feature gates

Core features that change how orders are stored are switched on per store. KahunaCart refuses to switch one on while an installed add-on has not declared that it understands it. The Settings → Features screen names any plugin that is blocking.

Switching a feature off is never refused.

Turning a whole subsystem off

Nine settings accept false in place of their whole block. The subsystem is then gone, not just switched off inside itself: its storefront routes stop being routes, the admin nav loses its entry, and the Twig variables are absent rather than empty.

The three forms

Each of these is the same instruction, and the plugin reads all three:

# 1. Off, at its shortest.
cart: false

# 2. Off, written inside the block. Use this form when the block also
#    carries settings you want to keep for when it comes back on.
cart:
  enabled: false
  purge_days: 90

# 3. On, which is what every one of them defaults to.
cart: true

feeds, storefront_mcp and ucp are the exception to the third comment: they ship off, so a config that does not mention them has them off, and feeds: true switches the feeds on with every other key at its default. All three also need agentic.enabled on.

Use the second form in a file you edit by hand. cart: false replaces the whole block, so writing it and later writing cart: true loses purge_days along the way. enabled: false keeps everything and turns one switch.

Settings that disagree with each other

Some combinations are individually valid and jointly wrong. GET /kahunacart/config/contradictions reports them, and the Features screen shows them with a button that writes the fix. Every rule is published whether or not it fires.

The fix is merged into your own configuration file, so everything the file already holds survives. Comments in the file are not preserved; the values are.

Moving a configuration between stores

bin/plugin kahunacart config:export and config:import move a store's configuration as a JSON document, and the admin has the same two behind kahunacart.settings. See CLI.

The catalogue is not included; that is bin/plugin kahunacart export. Orders and customers are not included either, and nor is the store status: an import keeps the target store's own whatever the document says, so moving configuration from staging to live neither pauses nor opens the live store. To move the whole store, settings, catalogue, customers and orders together, use a store bundle. See Export and restore.

Amounts in other currencies. On a store that sells in more than one currency, the shipping section also carries what its methods and collection points charge in each currency, and the promotions section carries what its coupons and sale rules are worth in each, including fixed quantity-tier amounts and named money arguments. They travel as a currency_amounts list in the section, one row per amount (the kind of thing it belongs to, its id, the field, the currency and the amount in minor units), and only when the store has some, so a store that sells in one currency exports exactly what it always did. The prices of products are not part of this: they move with the catalogue export.

An import clears the section’s old foreign amounts even when all extra currencies are disabled. An imported id cannot inherit an old amount when a currency is enabled again.

Each imported section replaces its foreign amounts with the document’s amounts. A document with none clears them. The dry run says how many amounts would be replaced. If the document names a currency the target store does not sell in, the whole import is refused. Enable that currency and run the import again.

Two rows are never exported and never deleted by an import: reports.stats_through and reports.stats_schema. They describe this store's own rollup and would mislead another store. See Reports and the rollup.

Related

• Getting started — install, first product, first sale.
• The catalog index — what the index holds, when it is joined, and how to rebuild it.
• Storefront — the search ladder and what each rung changes for a shopper.
• Price lists and quantity tiers — what pricing.enabled governs.
• Importing — the CSV importer and its saved mappings.
• Tax — tax zones and rates.
• Customers, wishlists, reviews and retention — what the wishlist, review and retention keys govern.
• Store credit, gift cards and credit notes — the ledger the credit and gift-card keys govern.
• Order changes — what features.order_versioning turns on.
• Shipping — shipping zones and rates.
• Pickup — click and collect, and shipping.pickup_enabled.
• Coupons — coupon codes, stacking and campaigns.
• Checkout fields — what checkout.fields_enabled governs.
• Countries and addresses — address layouts, country rules and the address.* keys.
• Cart recovery — restore links, reminders, share links and the email log.
• Digital products — download grants and delivery methods.
• Customer accounts — store accounts and the account area.
• Hardening — order-link expiry, rate limits, trusted proxies, and the web-server rules the data directories need.
• Analytics — what the four reports.* keys govern.
• Dashboard alerts — what the two alerts.* keys govern.
• Product lifecycle — revisions, scheduling and queued changes.
• Deposits — part payment and the deposit keys.
• Shipping rates — carrier rates, packages and cost expressions.
• Tax drivers — what tax.engine points at.
• CLI — every bin/plugin kahunacart command.
• Object templates — the formats the store edits rather than configures.
• Storefront JSON API — what storefront_api.enabled answers.
• Outbound webhooks — what the four webhooks.* keys govern.
• Demo store — what demo.readonly and demo.protected_customers do.
• Currencies — selling in more than one currency