Settings

Settings is where you connect external services, manage API access, add team members, and configure store-wide behavior. Some actions here move real money or change who can do what, so a few require re-authentication.

Integrations

Settings → Integrations is where your store connects to the services it runs on. Each store supplies its own credentials, so your money, mail, and shipping run on your accounts.

Stripe (payments)

Payments run through your own Stripe account — Orchard orchestrates checkout and records orders, but funds settle to you and Orchard never handles card data.

1. Go to Settings → Integrations → Stripe.
2. Connect your Stripe account (connect flow or by entering keys, depending on your setup). Both direct and connect arrangements are supported.
3. Provide test and live credentials so you can rehearse in test mode before going live.
4. Save. Orchard configures the Stripe webhook it needs to learn about payments automatically.

Until Stripe is connected and in live mode, customers can’t complete a real purchase. Test mode lets you place test orders with Stripe test cards.

Email

Connect your own email provider and domain so order confirmations and shipment notices come from your brand, not Orchard’s. Add the provider credentials under Settings → Integrations → Email and verify your sending domain per the provider’s instructions.

Shipping

Connect your carrier account so you can buy labels and get rates at fulfillment time. Standard parcel shipping works out of the box; heavy/freight (LTL) is a separate capability your operator enables.

Other services

Stores can also connect support tooling, analytics, and similar services here. Each is per-store and optional.

API keys

If you (or a developer you work with) build against Orchard’s API, you manage keys under Settings → API keys.

1. Go to Settings → API keys.
2. Click Create key, give it a clear name (for example, “Storefront server”), and choose the scopes it needs — grant the minimum required.
3. Pick test or live.
4. Copy the key when it’s shown. Secret keys (sk_…) are shown once — store it in a password manager or your platform’s secret store immediately.

• sk_… (secret) keys are server-side only. Never put them in a browser or commit them to code.
• pk_… (publishable) keys are browser-safe and carry only read scopes plus checkout.
• Rotate on exposure. If a key leaks, revoke it here and create a new one.

For the developer side of keys and scopes, see Authentication.

Webhooks

If an external system needs to react to events in your store (a new paid order, a refund, a subscription change), configure outbound webhooks under Settings → Webhooks.

1. Go to Settings → Webhooks and click Add endpoint.
2. Enter the URL that will receive events (an HTTPS endpoint your developer provides).
3. Select the event types to subscribe to (for example, order.paid, order.refunded, subscription.*).
4. Save. Orchard shows a signing secret — copy it now; it’s used to verify that deliveries really came from Orchard, and it’s shown only when created or regenerated.
5. Click Test to send a webhook.ping and confirm the endpoint receives it.

• Lifecycle events deliver within about five minutes (they’re queued, not instant). Failed deliveries retry automatically.
• The delivery log shows each attempt’s response code so you can debug a misbehaving endpoint.
• Regenerating the secret invalidates the old one immediately — update the receiver at the same time.

For the developer side, see Webhooks and Verifying signatures.

Users and roles

Add teammates and control what they can do under Settings → Users & roles.

1. Go to Settings → Users & roles.
2. Click Invite user, enter their email, and assign a role.
3. They receive an email to set up their login. Store admins sign in with email and password; two-factor (TOTP) is available and recommended.

Roles determine which admin areas a person sees and what they can change — for example, a fulfillment role might see Orders and Inventory but not Settings or Reports. Grant the least access each person needs. Sensitive actions (removing a user, viewing secrets, destructive changes) may prompt for re-authentication.

Store-wide settings

Depending on your store, this area also covers:

• Store profile — name, contact email, time zone, currency.
• Low-stock defaults — the threshold used when an item has none set (see Inventory).
• Feature toggles — turn optional capabilities (such as customer accounts or subscriptions) on or off. Some are billable; confirm with your operator before enabling.
• Domains — the storefront domain configuration (often handled with your operator).

Common questions

• Customers can’t check out. Confirm Stripe is connected and in live mode, and that your products are published and priced.
• Confirmation emails aren’t sending. Confirm the email integration is connected and your sending domain is verified.
• A teammate can’t see a section. Their role doesn’t include it. Adjust the role under Users & roles.
• I lost an API key / webhook secret. They’re shown once. Create a new key, or regenerate the webhook secret (and update the receiver).

That’s the full day-to-day reference. For the concepts behind these screens, see Concepts; for building on the API, see Developers.