Configure Decisions

All preferences are managed under Merchant Tools > Site Preferences > Site Custom Preferences, in four groups: Forter - Core Configuration, Forter - Fraud Order Management, Forter - Development Debug, and Forter - Account Protection. Recommended order: configure Core, then Orders, verifying both via the bm_forter module. Dev holds testing preferences and applies regardless of setup. Account Protection is optional and not required for a working integration.

Core

The credentials and identifiers the cartridge needs to reach the Forter API. All four required preferences must be set before Forter functions.

Preference	Default	Description
forterEnabled	true, required	Master on/off switch. When false, no Forter API calls are made and no JS is injected. Set this last during initial configuration.
forterSiteID	required	Your Forter Site ID. See API Credentials.
forterSecretKey	required	Your Forter API Secret Key. See API Credentials.
versionAPI	10.1, required	The Forter API version, sent in the api-version header. See API Credentials.
forterExtensionVersion	2.0.0	Identifies the cartridge version to Forter's backend. Internal.
forterClient	demandware	Identifies the e-commerce platform. Internal.
forterAccountType	PRIVATE	Customer account type. Defaults to PRIVATE.
forterMerchantAccountStatus	open	Default account status sent to Forter in account-protection events.
forterChannelType	WEB	Channel through which customers interact. Defaults to WEB.

Orders

Controls how the cartridge handles Forter's fraud decisions during checkout. See Fraud Management for the full decision flow.

Preference	Default	Description
forterAuthTiming	POST_AUTH, required	POST_AUTH (called after payment authorization — safest starting point), PRE_AUTH (called before authorization — saves authorization fees on declines), or PRE_AND_POST_AUTH (both, in sequence).
forterCancelOrderOnDecline	false	When true and Forter returns DECLINED, voids the order via OrderMgr.failOrder(). When false, the order is placed without capture for manual review.
forterAutoInvoiceOnApprove	false	When true and Forter returns APPROVED, captures funds immediately. Usually left false (capture at shipping).
forterShowDeclinedPage	true	When true (and cancel is enabled), the customer sees the custom decline message. When false, they see a generic checkout error.
forterCustomDeclineMessage	—	The message shown to the customer on decline.
forterWeeksAmount	4	How many weeks back the ForterOrderUpdateSFRA job looks when syncing order status.
forterMaxValidationAttempts	2	Max total attempts for a single order before failing open. Default 2 means 1 retry after the initial attempt.
forterEnableLegacyOrderRequest	false	Leave disabled unless Forter instructs otherwise, for backward compatibility.

Dev

For development and testing only. Confirm all of these are at their production values before go-live.

Preference	Default	Production value	Description
forterEnableDebugLogging	true	false	Logs full Forter API request and response bodies, including PII.
forterForceForterDecision	DISABLED	DISABLED	Overrides the customer's IP with a Forter test IP to force a deterministic response for Account Protection events (login, registration, profile updates). Has no effect on order decisions, which are forced by which test account places the order instead. See Account Protection Decision Testing and Order Decision Testing.
forterAccountAPIMockStatus	STATUS_APPROVED	STATUS_APPROVED	Mocks the Account Protection API response for testing account-protection events.

Abuse policies

Abuse policies require no SFCC-side configuration. Policy types, actions, and enforcement are all managed in the Forter Portal's Policy Builder. See Abuse Prevention for how a policy-driven decision is handled at checkout.

Account Protection

forterAccountProtectionEnabled gates Forter calls on login, registration, and profile-update events. See Account Protection for the available response actions and how they're triggered.

ForterOrderUpdateSFRA job

Configure at Administration > Operations > Jobs > ForterOrderUpdateSFRA. See Order Status Sync for what the job does. Its lookback window is set separately, via forterWeeksAmount in the Orders group above.

Setting	Notes
Site Context	Must match your actual site ID, if you changed it from RefArch during metadata import.
Schedule	Defaults to every 5 minutes, every day. Adjust based on order volume.
Trigger	Ships enabled by default. Disable it temporarily if you don't want status syncs firing before the rest of your setup is complete.

Recommended configuration by phase

Phase	forterEnabled	forterForceForterDecision	forterCancelOrderOnDecline	forterEnableDebugLogging
1. Integration	true	Enabled (test IPs)	false	true
2. UAT/Staging	true	DISABLED	true	true
3. Production	true	DISABLED	Per business policy	false