This guide describes how to launch a Progressive Web App (PWA) Kit storefront and make it accessible from its official, public web address.
Throughout this guide we use an example storefront with the following attributes:
https://www.example.comexamplestaging and productionBefore running the commands, replace any placeholders with actual values. Placeholders are formatted like this: $PLACEHOLDER.
This guide assumes that you have access to the Runtime Admin web application and the Managed Runtime API to perform administrative tasks. To get access to these tools, contact your B2C Commerce administrator and ask them to add either one of the following roles to your account using Account Manager: Managed Runtime User or Managed Runtime Admin.
To make requests to the Managed Runtime API, you must include an API key in the HTTP request Authorization header with the value, Bearer $API_KEY. For all the sample requests provided, don’t forget to replace $API_KEY with your actual API key.
To find your API key, log in to Runtime Admin and go to the Account Settings page.
Important: Treat your API key like a password because it allows scripts to complete operations on your behalf.
You need access to your DNS provider to create and update CNAME records, as well as access to your third-party CDN provider (as applicable).
In this guide, the word “Mobify” appears in a few places. Mobify is the name of the company that originally developed the technology that became PWA Kit and Managed Runtime. In 2020, Salesforce acquired Mobify along with all of its technology.
The Mobify brand name appears in the mobify-storefront.com domain used to host your storefront and the cloud.mobify.com domain used by the Managed Runtime API.
If you need to add conditional logic that alters the behavior of your site depending on the domain used, it’s easier to test this logic when your local development server can use a custom domain. Why would you need to add this kind of logic? Consider, for example, the need to look up a different SLAS Client ID depending on the domain.
To run your local development server using a custom domain:
127.0.0.1 (localhost).ssr.js.options passed to runtime.createHandler, set the port to 80.EXTERNAL_DOMAIN_NAME=www.example.com npm start, replacing the value of example.com with your custom domain. Running the server on port 80 can sometimes require administrative privileges.Requests from your browser to the custom domain are now resolved and routed to your local development server!
The process for launching an environment is the same for staging and production, with the only difference being the domain name and the Managed Runtime environment used.
We strongly recommend going through the launch process on a staging environment first before repeating the process on production. These steps should be completed as soon as you start a PWA Kit project and at least two weeks before your launch date.
Warning
For the instructions provided, imagine you’re launching a storefront at staging.example.com, your project ID in Managed Runtime is example, and your bundle is deployed to an environment called staging.
Use Runtime Admin or Managed Runtime API to create an environment called staging to practice launching the storefront.
Here’s a sample request that uses the projects_target_create endpoint to create an environment. Replace example in the request with your actual project ID string and $API_KEY with your API key:
1curl 'https://cloud.mobify.com/api/projects/example/target/' \
2 --request 'POST' \
3 --header "Authorization: Bearer $API_KEY" \
4 --header 'Content-Type: application/json' \
5 --data '{ "name" : "staging" }'For instructions on creating an environment with Runtime Admin, see our guide to Managed Runtime Administration.
Many PWA Kit implementations make requests to OCAPI or controllers in addition to B2C Commerce API.
You must ensure your B2C Commerce instance is reachable by Managed Runtime.
Making the APIs reachable typically involves configuring eCDN to make your B2C Commerce instance available at an alternative domain like ecom.example.com. For more information, refer to the eCDN setup and configuration documentation.
After your domain is configured, update your environment’s proxy settings to use it. For more information, see our guide to Proxying Requests.
This step is not required when using a third-party CDN or eCDN. Consult your CDN vendor documentation for configuring certs.
Important
If you are routing traffic directly to the Managed Runtime CDN, then Managed Runtime issues and manages TLS certificates on your behalf.
Organization Admins and Organization Users with the Managed Certificates permission can now manage TLS certificates directly through Runtime Admin. This provides enhanced control over certificate lifecycle management without requiring support tickets for routine certificate operations.
Prerequisites for Certificate Management:
If you have the appropriate permissions, you can request certificates directly through Runtime Admin. See Organization Certificate Management
Make sure that these requirements are met.
CAA records are set to allow AWS to issue certs by including these values:10 issue "amazon.com"
20 issuewild "amazon.com"Managed Runtime automatically renews TLS certificates as long as:
CAA records are set to allow AWS to issue certs by including these values:10 issue "amazon.com"
20 issuewild "amazon.com"This step isn’t required when using a third-party CDN or eCDN.
Important
Reduce the time to live (TTL) for staging.example.com to one minute. Reducing the TTL speeds up the DNS cutover process, and if something goes wrong, allows you to roll back quickly.
You can verify the TTL using the dig command:
1dig +nocmd +noall +answer 'staging.example.com'Set an environment’s access control header using Runtime Admin’s Access Control Settings or the access_control_header API.
In this example, we use the API to set an access control header with the header value 25pn5dec7f1c:
1curl "https://cloud.mobify.com/api/projects/$PROJECT/target/$TARGET/access-control-header/" \
2 --header "Authorization: Bearer $API_KEY" \
3 --header 'Content-Type: application/json' \
4 --data '{ "value" : "25pn5dec7f1c" }'The access control header value will be used during Perform the Cutover to prevent direct access to the environment.
Configure the environment to receive traffic from the host staging.example.com.
staging.example.com or *.example.com).Optionally, you can configure the environment via the API. Update the environment’s ssr_external_domain and ssr_external_hostname settings using the projects_target_partial_update API.
1curl 'https://cloud.mobify.com/api/projects/example/target/staging/' \
2 --request 'PATCH' \
3 --header "Authorization: Bearer $API_KEY" \
4 --header 'Content-Type: application/json' \
5 --data '{
6 "ssr_external_domain": "example.com",
7 "ssr_external_hostname": "staging.example.com"
8}'After this step, the environment is no longer accessible at its mobify-storefront.com or exp-delivery.com default domain.
Important
Verify that the new settings are in effect using a cURL command that makes a request with DNS spoofing:
1curl 'https://staging.example.com' \
2 --resolve 'staging.example.com:443:'"$(dig +short 'example-staging-cdn.sfdc-8tgtt5-ecom1.exp-delivery.com' | tail -n1)"The cutover process is different depending on whether you use a third-party CDN, eCDN, or the Managed Runtime CDN.
Configure your Managed Runtime environment as an origin in your CDN:
Host header to match your environment {{project}}-{{environment}}.sfdc-8tgtt5-ecom1.exp-delivery.comx-sfdc-access-control header value if configured for your environmentRefer to your CDN provider documentation for detailed guidance.
Managed Runtime routes requests to environments using the HTTP Host header. Requests with an incorrect host are rejected with an HTTP 403 Bad Request response.
Note
Consider adding a handler to reflect HTTP requests and verify that your CDN is configured correctly:
1// ssr.js
2app.all('/echo', function echoHandler({method, path, headers, body}, res) {
3 res.send({method, path, headers, body})
4})Also consider adding a proxy with httpbin.org/anything to verify headers passed to proxies are sent correctly.
If you encounter issues, use the techniques described in Debug PWA Kit Apps.
Update your eCDN routing rules to route traffic to your Managed Runtime environment. Review the eCDN MRT Rules guide for more information. You can also Configure MRT Routing Rules in Business Manager.
Use the upsertOriginHeaderModification API to set the headerValue to the same ones that you used in step 5. That way, only traffic from eCDN is allowed.
In this example, we use the API to set an access control header with the header value 25pn5dec7f1c:
1curl "https://$CODE.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/$ORG/zones/$ZONE/origin-header-modification/mrt" \
2 --method 'PUT' \
3 --header "Authorization: Bearer $TOKEN" \
4 --header 'Content-Type: application/json' \
5 --data '{ "headerValue" : "25pn5dec7f1c" }'Perform a DNS cutover to point your domain from the old origin to the Managed Runtime CDN.
To find the correct DNS values for your environment, check the DNS configuration in Environment Settings.
Alternatively, the Managed Runtime CDN stable domain follows the convention of one of these default domains:
{{project}}-{{environment}}-cdn.sfdc-8tgtt5-ecom1.exp-delivery.com{{project}}-{{environment}}-cdn.mobify-storefront.comWhere {{project}} is your project ID, and {{environment}} is your environment ID.
staging.example.com to the value shown in your DNS configuration (e.g., example-staging-cdn.sfdc-8tgtt5-ecom1.exp-delivery.com).staging.example.com.Congrats, you’ve completed your launch! 🥳
After completing these instructions for a staging site, you can repeat the same process with the production domain and production environment.
From here, the Customer Success Group assists you in monitoring the site’s traffic to make sure that the launch has succeeded. The goal is to ensure that everything happens as expected during launch!
After launch, customers with a Signature Success Plan receive proactive site monitoring. To take advantage of this increased monitoring service, you must mark your environment as production. For more information, see the section on environments in the Managed Runtime Overview.
ssr_external_hostname target setting controls which host the environment receives traffic from. If the HTTP Host header of a request doesn’t match this value, the request fails with a 403 error.example.com (with no www subdomain). To use a bare domain, you must set up a server to redirect requests from the bare domain to your CNAME.
j