Spryker Documentation

Set up data export to S3

Tue, 14 Jul 2026 11:03:46 +0000

Export your Spryker data tables to a secure, structured S3 bucket to enable different uses cases, such as analysis, integrations, or AI modeling. Based on configurable frequency tables are automatically exported to a dedicated S3 bucket in `.parquet` format. These exports are ideal for connecting external analytics and reporting tools. Access to the S3 bucket is secured and audited via AWS IAM policies. Every file access is logged for compliance and traceability. ## Request an export setup Open a support ticket and include the following information: - List of tables you want exported, comma-separated - Desired frequency: every 6h, 12h, 1d, 2d, 1 week, or 1 month. - Desired Start date and time, ISO 8601 format recommended Our team will validate and set up the export for you. ## Limitations and recommendations - Blacklisted tables and columns: Tables known to contain sensitive information, such as credentials or internal data in `spy_user`, `spy_customer` or `spy_api_key` tables, are automatically excluded to prevent security breaches. - Only full export: The system exports full table snapshots each time. Consider frequency carefully to avoid unnecessary outbound traffic costs. - Retention policy: Exported files are retained for seven days and then automatically deleted to optimize storage. - We recommend reviewing your export requests to ensure no credentials or compliance-relevant fields are included.

Configure services

Mon, 13 Jul 2026 14:48:42 +0000

This document describes how to configure services shipped by default.

Prerequisites

Install or update the Docker SDK to the latest version:

git clone https://github.com/spryker/docker-sdk.git ./docker

Service versions

When configuring a service, you need to define its version. The Docker SDK supports the following service versions:

SERVICE	ENGINE	VERSIONS	ARM SUPPORT	NOTE
datab	postgres	17	✓
		10	✓
		11	✓
		12	✓
	mysql	5.7
		8.4
		mariadb-10.2	✓
		mariadb-10.3	✓
		mariadb-10.4	✓
		mariadb-10.5	✓
		mariadb-10.6	✓
		mariadb-10.11	✓
		mariadb-11.4	✓
		mariadb-11.8	✓
broke	rabbitmq	3.7
		3.8	✓
		3.9	✓
		4.1	✓
session	redis	5.0	✓
	valkey	7.2	✓
key_value_store	redis	5.0	✓
	valkey	7.2	✓
search	elastic	5.6*	✓	Policy and Product End of Life Dates
		6.8	✓	Policy and Product End of Life Dates
		7.6	✓
		7.10	✓
	opensearch	1.3	✓	Support Schedule
scheduler	jenkins	2.176
		2.305	✓
		2.324	✓
		2.516.3	✓
webdriver	phantomjs	latest*
	chromedriver	latest	✓
mail_catcher	mailhog	1.0	✓
swagger	swagger-ui	v3.24	✓
kibana	kibana	5.6*	✓
		6.8	✓
		7.6	✓
		7.10	✓
blackfire	blackfire	latest	✓

Database services

MariaDB is provided as a service by default. MariaDB is about 40% faster on write operations when compared, for example, to PostgreSQL.

You can switch to MySQL or PostgreSQL as described in the following sections.

MariaDB

MariaDB is a community-developed, commercially supported fork of the MySQL relational database management system.

For more details, see MariaDB knowledge base.

Default service

MariaDB is provided as a service by default. You may only need to use this configuration if you are running an older version of the Docker SDK or if you’ve previously switched to another database engine.

Configure MariaDB

To switch the database service to MariaDB, follow these steps:

In deploy.*.yml, adjust the services section:

...
services:
    database:
        engine: mysql
        version: mariadb-11.8
        ...
        endpoints:
            localhost:3306:
...

Bootstrap the docker setup, regenerate demo data, and rebuild the application:

docker/sdk boot deploy.*.yml
docker/sdk clean-data
docker/sdk up --build --data

MySQL

MySQL is an open-source relational database management system based on Structured Query Language (SQL). MySQL allows data to be stored and accessed across multiple storage engines, including InnoDB, CSV, and NDB. Also, MySQL can replicate data and partition tables for better performance and durability.

For more details, see MySQL documentation.

Configure MySQL

To switch the database engine to MySQL, follow these steps:

In deploy.*.yaml, adjust the services section:

...
services:
    database:
        engine: mysql
        ...
        endpoints:
            localhost:3306:
...

Bootstrap the docker setup, regenerate demo data, and rebuild the application:

docker/sdk boot deploy.*.yml
docker/sdk clean-data
docker/sdk up --build --data

PostgreSQL

PostgreSQL is an open-source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads.

For more details, see PostgreSQL documentation.

Configure PostgreSQL

To switch the database engine to PostgreSQL, follow these steps:

In deploy.*.yml, adjust the services section:

...
services:
    database:
        engine: postgres
        version: 17
        ...
        endpoints:
            localhost:5432:
...

Bootstrap the docker setup, regenerate demo data, and rebuild the application:

docker/sdk boot deploy.*.yml
docker/sdk clean-data
docker/sdk up --build --data

Elasticsearch

Elasticsearch is a search engine based on the Lucene library. It provides a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents.

For more information, see the following documents:

Configure Elasticsearch—describes ElastciSearch configuration in Spryker.
Elasticsearch documentation—provides detailed information about Elasticsearch.

Configure Elasticsearch

In deploy.*.yml, adjust the services section to open the port used for accessing Elasticsearch:

services:
    search:
        engine: elastic
        endpoints:
            localhost:9200
                protocol: tcp

Kibana UI

Kibana is an open-source analytics and visualization platform designed to work with Elasticsearch. You use Kibana to search, view, and interact with data stored in Elasticsearch indices. You can easily perform advanced data analysis and visualize your data in a variety of charts, tables, and maps.

For more information, see Kibana documentation.

In Docker SDK, Kibana UI is provided as a service by default.

Configure Kibana UI

To configure an endpoint for Kibana UI, follow these steps:

In deploy.*.yml, adjust the services section:

services:
    ...
    kibana:
        engine: kibana
        endpoints:
            {custom_endpoint}:

Add the endpoint to the hosts file:

echo "127.0.0.1 {custom_endpoint}" | sudo tee -a /etc/hosts

RabbitMQ

RabbitMQ is a messaging broker—an intermediary for messaging. It gives your applications a common platform to send and receive messages and your messages a safe place to live until received.

Configure RabbitMQ

In deploy.*.yml, adjust the services section to open the port used for accessing RabbitMQ:

services:
    broker:
    ...
        endpoints:
    ...
            localhost:5672:
                protocol: tcp
            api.queue.spryker.local:

Swagger UI

Swagger UI allows anyone—be it your development team or your end consumers—to visualize and interact with the API’s resources without having any of the implementation logic in place. It’s automatically generated from your OpenAPI (formerly known as Swagger) Specification, with the visual documentation making it easy for backend implementation and client-side consumption.

For more details, see Swagger UI documentation.

In Docker SDK, Swagger UI is provided as a service by default.

Rest API Reference in Spryker

Spryker provides the basic functionality to generate OpenApi schema specification for REST API endpoints. This document provides an overview of REST API endpoints. For each endpoint, you can find the URL, REST request parameters as well as the appropriate request and response data formats.

Configure Swagger UI

To configure an endpoint for Swagger UI, follow these steps:

In deploy.*.yml, adjust the services section:

services:
    ...
    swagger:
        engine: swagger-ui
        endpoints:
            {custom_endpoint}:

Add the endpoint to the hosts file:

echo "127.0.0.1 {custom_endpoint}" | sudo tee -a /etc/hosts

Redis

Redis is an open-source (BSD licensed), in-memory data structure store used as a database, cache, and message broker. It supports data structures such as strings, hashes, lists, sets, sorted sets with range queries, bitmaps, hyperloglogs, geospatial indexes with radius queries, and streams.

For more information, see Redis documentation.

Configure Redis

In deploy.*.yml, adjust the services section to open the port used for accessing Redis:

services:
    key_value_store:
        engine: redis
        endpoints:
            localhost:16379:
                protocol: tcp

Redis GUI

Redis Commander is a web management tool that provides a graphical user interface to access Redis databases and perform basic operations like view keys as a tree, view CRUD keys, or import and export databases.

Configure Redis GUI

To configure an endpoint for Redis Commander, follow the steps:

In deploy.*.yml, adjust the services section:

services:
...
    redis-gui:
        engine: redis-commander
        endpoints:
            {custom_endpoint}: //redis-commander.spryker.local:

Adjust hosts file:

echo "127.0.0.1 {custom_endpoint}" | sudo tee -a /etc/hosts

MailHog

MailHog is a mail catcher service that is used with Spryker in Docker for Demo and Development environments. Developers use this email testing tool to catch and show emails locally without an SMTP (Simple Mail Transfer Protocol) server.

With the MailHog service, developers can do the following:

Configure an application to use MailHog for SMTP delivery.
View messages in the web UI or retrieve them via JSON API.

By default, the following applies:

http://mail.demo-spryker.com/ is used to see incoming emails.
Login is not required.

Configure MailHog

In deploy.*.yml, adjust the services section to specify a custom endpoint:

services:
        ...
        mail_catcher:
                engine: mailhog
                endpoints:
                          {custom_endpoint}:

Blackfire

Blackfire is a tool used to profile, test, debug, and optimize the performance of PHP applications. It gathers data about consumed server resources like memory, CPU time, and I/O operations. The data and configuration can be checked through the Blackfire web interface.

While we recommend Blackfire for PHP code profiling, Blackfire is not compatible with OpenTelemetry (OTel). If OTel resolves this compatibility in future, we will inform you. Meantime, for profiling needs compatible with OTel, we suggest using tools like Tideways, which can integrate seamlessly with your OTel-based monitoring stack.

Configure Blackfire

To enable Blackfire, follow these steps:

In the image section, adjust deploy.*.yml to enable the Blackfire PHP extension:

image:
    tag: spryker/php:7.4 # Use the same tag you had in `image`
    php:
        ...
        enabled-extensions:
            - blackfire

In deploy.*.yml, adjust the services section to configure the Blackfire client:

services:
    ...
    blackfire:
        engine: blackfire
        server-id: {server_id}
        server-token: {server_token}
        client-id: {client_id}
        client-token: {client-token}

Alternative configuration

Use the following configuration if you are going to change server or client details often or if you don’t want to define them in your deploy file.

To enable Blackfire, follow these steps:

In the image section, adjust deploy.*.yml to enable the Blackfire PHP extension:

image:
    tag: spryker/php:7.4 # Use the same tag you had in `image`
    php:
        ...
        enabled-extensions:
            - blackfire

In the services section, adjust deploy.*.yml to enable the Blackfire service:

services:
    ...
    blackfire:
        engine: blackfire

Pass Blackfire client details:

BLACKFIRE_CLIENT_ID={client_id} BLACKFIRE_CLIENT_TOKEN={client-token} docker/sdk cli

Pass Blackfire server details:

BLACKFIRE_SERVER_ID={client-token} BLACKFIRE_SERVER_TOKEN={server_token} docker/sdk up

You can pass the server details only with the docker/sdk up command.

It is not obligatory to pass all the details as environment variables or define all the details in the deploy file. You can pass the details in any combination.

New Relic

New Relic is a tool used to track the performance of services and the environment to quickly find and fix issues.

The solution consists of a client and a server. The client is used to collect data about applications in an environment and send it to the server for further analysis and presentation. The server is used to aggregate, analyse, and present the data.

Prerequisites

New Relic license key: NEWRELIC_LICENSE
NewRelic account ID: NEWRELIC_ACCOUNT_ID
NewRelic insights key: NEWRELIC_INSIGHTS_KEY
The New Relic module.

Install the New Relic module

While most environments come with New Relic already available, you may need to add the module to your project. Add the module to your composer.json:

composer require spryker-eco/new-relic

SCCOS: Configure New Relic

Adjust deploy.*.yml in the image: section:

image:
    ...
    php:
        ...
        enabled-extensions:
            ...
            - newrelic
    environment:
        ...
        NEWRELIC_CUSTOM_APP_ENVIRONMENT: ENVIRONMENT_VALUE_HERE # staging, dev, production, uat

Push and deploy the changes using one of the following guides:

Submit an infrastructure change request via the Support Portal. Set up a Change Request for existing Parameter Store values and request your values to be set for the following parameters:

NEWRELIC_LICENSE
NEWRELIC_ACCOUNT_ID
NEWRELIC_INSIGHTS_KEY

Once New Relic is enabled, in the New Relic dashboard, you may see either company-staging-newrelic-app or YVES-DE (docker.dev). New Relic displays these APM names by the application name setup in the configuration files.

If you update the name of an application, contact support to update the changes in your APM.

Local: Configure New Relic

In deploy.*.yml, adjust the docker section:

docker:
    newrelic:
        license: {new_relic_license}
	distributed-tracing:
            enabled: true

In the deploy.*.yml, adjust the image section:

image:
    ...
    php:
        ...
        enabled-extensions:
            ...
            - newrelic

Configure YVES, ZED, and GLUE as separate APMs

By default, in the New Relic dashboard, the APM is displayed as company-staging-newrelic-app. To improve visibility, you may want to configure each application as a separate APM. For example, YVES-DE (docker.dev).

To do it, add the NewRelicMonitoringExtensionPlugin by creating the class src/Pyz/Service/Monitoring/MonitoringDependencyProvider.php:

<?php declare(strict_types = 1);
​
/**
 * This file is part of the Spryker Commerce OS.
 * For full license information,  view the LICENSE file that was distributed with this source code.
 */
​
namespace Pyz\Service\Monitoring;
​
use Spryker\Service\Monitoring\MonitoringDependencyProvider as SprykerMonitoringDependencyProvider;
use Pyz\Service\NewRelic\Plugin\NewRelicMonitoringExtensionPlugin;
​
class MonitoringDependencyProvider extends SprykerMonitoringDependencyProvider
{
    /**
     * @return \Spryker\Service\MonitoringExtension\Dependency\Plugin\MonitoringExtensionPluginInterface[]
     */
    protected function getMonitoringExtensions(): array
    {
        return [
            new NewRelicMonitoringExtensionPlugin(),
        ];
    }
}

Next, create the class src/Pyz/Service/NewRelic/Plugin/NewRelicMonitoringExtensionPlugin.php

<?php
​
/**
 * MIT License
 * For full license information,  view the LICENSE file that was distributed with this source code.
 */
​
namespace Pyz\Service\NewRelic\Plugin;
​
use SprykerEco\Service\NewRelic\Plugin\NewRelicMonitoringExtensionPlugin as SprykerNewRelicMonitoringExtensionPlugin;
​
class NewRelicMonitoringExtensionPlugin extends SprykerNewRelicMonitoringExtensionPlugin
{
    /**
     * @param string|null $application
     * @param string|null $store
     * @param string|null $environment
     *
     * @return void
     */
    public function setApplicationName(?string $application = null, ?string $store = null, ?string $environment = null): void
    {
        if (!$this->isActive) {
            return;
        }
​
        // Custom application environment name, or use $environment as fallback
        $environment = getenv('NEWRELIC_CUSTOM_APP_ENVIRONMENT') ?: $environment;
​
        $this->application = $application . '-' . $store . ' (' . $environment . ')';
​
        newrelic_set_appname($this->application, '', false);
    }
}

Some builds have the Monitoring service built into the Yves application. If src/Pyz/Service/Monitoring/MonitoringDependencyProvider.php does not exist, you may want to check src/Pyz/Yves/Monitoring/.
If the class is missing from the Monitoring service, create it.

With new \SprykerEco\Service\NewRelic\Plugin\NewRelicMonitoringExtensionPlugin() being returned with the getMonitoringExtensions() function, the Monitoring class includes New Relic. Now applications are displayed as separate APMs, and an appropriate endpoint or class is displayed with each transaction.

Track deployments

To notify New Relic about new deployments, include the console command \SprykerEco\Zed\NewRelic\Communication\Console\RecordDeploymentConsole in \Pyz\Zed\Console\ConsoleDependencyProvider as follows:

namespace Pyz\Zed\Console;

...
use SprykerEco\Zed\NewRelic\Communication\Console\RecordDeploymentConsole;
...

class ConsoleDependencyProvider extends SprykerConsoleDependencyProvider
{
...
    protected function getConsoleCommands(Container $container): array
    {
        $commands = [
	    ....
            new RecordDeploymentConsole(),
        ];
	....
        return $commands;
    }
....
}

From now on you can use the record deployment functionality built-in in the console command, as follows:

vendor/bin/console newrelic:record-deployment <AppName>

where AppName corresponds to the preconfigured in NewRelicEnv::NEW_RELIC_APPLICATION_ID_ARRAY. For more details, see Upgrade the Monitoring module

Webdriver

PhantomJS is provided as a webdriver service by default, but you can switch to ChromeDriver as described below.

ChromeDriver

ChromeDriver is a thin wrapper on WebDriver and a Chromium headless browser. It is used for automating web page interaction, JavaScript execution, and other testing-related activities. It provides full-control API to make end-to-end testing flexible and comfortable.

Configure ChromeDriver

To enable Chromedriver, adjust deploy.*.yml as follows:

services:
    webdriver:
        engine: chromedriver

PhantomJS

PhantomJS is a headless browser for automating web page interaction. It ships with a WebDriver based on Selenium.

Configure PhantomJS

To enable PhantomJS, adjust deploy.*.yml as follows:

services:
    webdriver:
        engine: phantomjs

Dashboard

Dashboard is a tool that helps to monitor logs in real time. You can monitor logs in all or a particular container.

Configure dashboard

To configure Dashboard, in the services section, adjust deploy.*.yml:

services:
    dashboard:
            engine: dashboard
            endpoints:
                {custom_endpoint}:

Tideways

Tideways is an application profiler used for testing and debugging. Its main functions are profiling, monitoring, and exception tracking.

Configure Tideways

To configure Tideways, do the following:

In deploy.*.yml, adjust the services section:

services:
    tideways:
        apikey: {tideways_api_key}
        engine: tideways
        environment-name: {tideways_environment_name}
        cli-enabled: {true|false}

In the image section of deploy.*.yml, add Tideways to the list of enabled extensions:

image:
    tag: spryker/php:7.4 # the image tag was previously used in `image`
    php:
        ...
        enabled-extensions:
            - tideways

CloudHub

Fri, 10 Jul 2026 12:03:10 +0000

CloudHub is a centralized self-service portal that lets you manage your Spryker infrastructure directly, without raising manual support requests for routine tasks. It provides a streamlined interface for provisioning resources and managing access.

Technical teams can use CloudHub to maintain a clear overview of their cloud assets and keep access and storage resources aligned across environments, such as staging and production.

CloudHub includes the following panels:

User management (IAM): Provision and manage IAM users, configure VPN access, and manage SSH public keys.
User management (SSO): Provision and manage SSO users, configure VPN access.
Storage management (S3): Provision and manage S3 buckets across your environments.
Maintenance: View upcoming maintenance windows and scheduled infrastructure updates.
Service links: Access environment services such as Jenkins, RabbitMQ, AWS Console, and KeyCloak via SSO.

Resource status and validation

CloudHub provides feedback on all infrastructure actions through the Processing Status column. This ensures transparency during the asynchronous provisioning process.

Status	Description
In Progress	The infrastructure change is currently being deployed or updated by the automation engine.
Error	The action could not be completed. CloudHub provides specific error details. There are two types of error user might face: • System errors: In this case, we create a HubSpot ticket for our operations team to handle the problem. The user will receive a ticket number to track progress. • Validation errors: Issues like “S3 bucket name already exists” which must be fixed by the user.
Active/Success	The resource is fully provisioned, validated, and ready for use in the designated environment.

Install Marketplace Dummy Payment

Fri, 10 Jul 2026 11:37:24 +0000

This document describes how to integrate the Marketplace Dummy Payment into a Spryker project. ## Install feature core Follow the steps below to install the Marketplace Dummy Payment feature core. ### Prerequisites Install the required features: | NAME | VERSION | INSTALLATION GUIDE | | - | - | - | | Spryker Core | {{page.release_tag}} | [Install the Spryker Core feature](/docs/pbc/all/miscellaneous/latest/install-and-upgrade/install-features/install-the-spryker-core-feature.html) | | Payments | {{page.release_tag}} | [Install the Payments feature](/docs/pbc/all/payment-service-provider/latest/base-shop/install-and-upgrade/install-the-payments-feature.html) | | Checkout | {{page.release_tag}} | [Install the Checkout feature](/docs/pbc/all/cart-and-checkout/latest/base-shop/install-and-upgrade/install-features/install-the-checkout-feature.html) | | Marketplace Merchant | {{page.release_tag}} | [Install the Marketplace Merchant feature](/docs/pbc/all/merchant-management/latest/marketplace/install-and-upgrade/install-features/install-the-marketplace-merchant-feature.html) | | Marketplace Order Management | {{page.release_tag}} | [Install the Marketplace Order Management feature](/docs/pbc/all/order-management-system/latest/marketplace/install-features/install-the-marketplace-order-management-feature.html) | ### 1) Install required modules using Сomposer Install the required modules using Composer: ```bash composer require spryker/dummy-marketplace-payment:^0.2.2 --update-with-dependencies ``` {% info_block warningBox "Verification" %} Make sure that the following modules have been installed: | MODULE | EXPECTED DIRECTORY | |-|-| | DummyMarketplacePayment | vendor/spryker/dummy-marketplace-payment | {% endinfo_block %} ### 2) Set up configuration Add the following configuration: | CONFIGURATION | SPECIFICATION | NAMESPACE | | ------------- | ------------ | ------------ | | config_default-docker.php | Default docker specific configuration of entire application | config/Shared/config_default-docker.php | | config_default.php | Default configuration of entire application | config/Shared/config_default.php | **config/Shared/config_default-docker.php** ```php use Spryker\Shared\DummyMarketplacePayment\DummyMarketplacePaymentConfig; $config[OmsConstants::ACTIVE_PROCESSES] = [ 'MarketplacePayment01', ]; $config[SalesConstants::PAYMENT_METHOD_STATEMACHINE_MAPPING] = [ DummyMarketplacePaymentConfig::PAYMENT_METHOD_DUMMY_MARKETPLACE_PAYMENT_INVOICE => 'MarketplacePayment01', ]; ``` **config/Shared/config_default.php** ```php use Spryker\Shared\DummyMarketplacePayment\DummyMarketplacePaymentConfig; $config[OmsConstants::ACTIVE_PROCESSES] = [ 'MarketplacePayment01', ]; $config[SalesConstants::PAYMENT_METHOD_STATEMACHINE_MAPPING] = [ DummyMarketplacePaymentConfig::PAYMENT_METHOD_DUMMY_MARKETPLACE_PAYMENT_INVOICE => 'MarketplacePayment01', ]; ``` ### 3) Set up transfer objects ```bash console transfer:generate ``` {% info_block warningBox "Verification" %} Make sure that the following transfer objects are generated: | TRANSFER | TYPE | EVENT | PATH | | --------- | ------- | ----- | ------------- | | DummyMarketplacePayment | class | created | src/Generated/Shared/Transfer/DummyMarketplacePayment | | Payment.dummyMarketplacePaymentInvoice | property | created | src/Generated/Shared/Transfer/Payment | | Order.dummyMarketplacePaymentInvoice | property | created | src/Generated/Shared/Transfer/Order | {% endinfo_block %} ### 4) Set up behavior Enable the following behaviors by registering the plugins: | PLUGIN | DESCRIPTION | PREREQUISITES | NAMESPACE | | --------- | ------- | ----- | ------------- | | MerchantProductItemPaymentMethodFilterPlugin | If not all order items contain of product reference, then filters dummy marketplace payment methods out. | | Spryker\Zed\DummyMarketplacePayment\Communication\Plugin\Payment\MerchantProductItemPaymentMethodFilterPlugin | **src/Pyz/Zed/Payment/PaymentDependencyProvider.php** ```php */ protected function getPaymentMethodFilterPlugins(): array { return [ new MerchantProductItemPaymentMethodFilterPlugin(), ]; } } ``` ### 5) Import data 1. Extend and import payment method data: **data/import/payment_method.csv** ```csv payment_method_key,payment_method_name,payment_provider_key,payment_provider_name,is_active dummyMarketplacePaymentInvoice,Invoice,DummyMarketplacePayment,Dummy Marketplace Payment,1 ``` | COLUMN | REQUIRED | DATA TYPE | DATA EXAMPLE | DATA EXPLANATION | |-|-|-|-|-| | payment_method_key | ✓ | string | dummyMarketplacePaymentInvoice | Payment method key. | | payment_method_name | ✓ | string | Invoice | Payment method name. | | payment_provider_key | ✓ | string | DummyMarketplacePayment | Payment provider key. | | payment_provider_name | ✓ | string | Dummy Marketplace Payment | Payment provider name. | | is_active | | boolean | 1 | Is payment method active. | 2. Extend and import payment store data: **data/import/payment_method_store.csv** ```csv payment_method_key,store dummyMarketplacePaymentInvoice,DE dummyMarketplacePaymentInvoice,AT dummyMarketplacePaymentInvoice,US ``` | COLUMN | REQUIRED | DATA TYPE | DATA EXAMPLE | DATA EXPLANATION | |-|-|-|-|-| | payment_method_key | ✓ | string | dummyMarketplacePaymentInvoice | Payment method key. | | store | ✓ | string | DE | Store identifier. | 3. Import data: ```bash console data:import payment-method console data:import payment-method-store ``` {% info_block warningBox "Verification" %} Make sure that the new payment method is added to the `spy_payment_method` and `spy_payment_method_store` tables in the database. {% endinfo_block %} ## Install feature frontend Follow the steps below to install the Dummy Payment feature frontend. ### 1) Add translations Append glossary according to your configuration: **data/import/glossary.csv** ```yaml DummyMarketplacePaymentInvoice,Invoice,en_US DummyMarketplacePaymentInvoice,Auf Rechnung,de_DE dummyMarketplacePaymentInvoice.invoice,Pay with invoice:,en_US dummyMarketplacePaymentInvoice.invoice,Auf Rechnung bezahlen:,de_DE checkout.payment.provider.DummyMarketplacePayment,Dummy Marketplace Payment,en_US checkout.payment.provider.DummyMarketplacePayment,Beispiel Marktplatz Zahlungsmethode,de_DE ``` Import data: ```bash console data:import glossary ``` {% info_block warningBox "Verification" %} Make sure that the configured data is added to the `spy_glossary_key` and `spy_glossary_translation` tables in the database. {% endinfo_block %} ### 2) Set up behavior Enable the following behaviors by registering the plugins: | PLUGIN | DESCRIPTION | PREREQUISITES | NAMESPACE | | --------- | ------- | ----- | ------------- | | DummyMarketplacePaymentHandlerPlugin | Expands Payment transfer with payment provider and payment selection. | | Spryker\Yves\DummyMarketplacePayment\Plugin\StepEngine\DummyMarketplacePaymentHandlerPlugin | | DummyMarketplacePaymentInvoiceSubFormPlugin | Creates sub form for Invoice payment method. | | Spryker\Yves\DummyMarketplacePayment\Plugin\StepEngine\SubForm\DummyMarketplacePaymentInvoiceSubFormPlugin | **src/Pyz/Yves/CheckoutPage/CheckoutPageDependencyProvider.php** ```php extendPaymentMethodHandler($container); $container = $this->extendSubFormPluginCollection($container); return $container; } /** * @param \Spryker\Yves\Kernel\Container $container * * @return \Spryker\Yves\Kernel\Container */ protected function extendPaymentMethodHandler(Container $container): Container { $container->extend(static::PAYMENT_METHOD_HANDLER, function (StepHandlerPluginCollection $paymentMethodHandler) { $paymentMethodHandler->add( new DummyMarketplacePaymentHandlerPlugin(), DummyMarketplacePaymentConfig::PAYMENT_METHOD_DUMMY_MARKETPLACE_PAYMENT_INVOICE ); return $paymentMethodHandler; }); return $container; } /** * @param \Spryker\Yves\Kernel\Container $container * * @return \Spryker\Yves\Kernel\Container */ protected function extendSubFormPluginCollection(Container $container): Container { $container->extend(static::PAYMENT_SUB_FORMS, function (SubFormPluginCollection $paymentSubFormPluginCollection) { $paymentSubFormPluginCollection->add(new DummyMarketplacePaymentInvoiceSubFormPlugin()); return $paymentSubFormPluginCollection; }); return $container; } } ``` {% info_block warningBox "Verification" %} Add a merchant product to a shopping cart, go to checkout and make sure that Dummy Payment Invoice payment method is available. {% endinfo_block %} ### 3) Optional: Configure the date of birth field By default, the Marketplace Invoice payment sub form renders a date of birth field with its validation. To hide the field and skip its validation, override `DummyMarketplacePaymentConfig::isDateOfBirthEnabled()` in your project to return `false`: **src/Pyz/Yves/DummyMarketplacePayment/DummyMarketplacePaymentConfig.php** ```php

User management (SSO)

Fri, 10 Jul 2026 11:14:34 +0000

{% info_block infoBox %} This feature is part of a gradual rollout and will be available to everyone eventually. We will notify your team once your project is onboarded. {% endinfo_block %} The **User management (SSO Users)** panel in [CloudHub](/docs/ca/dev/cloud-hub/cloud-hub.html) lets you control infrastructure access and define how team members connect to your environments in a unified and streamlined way while using one user to access everything. You can create, update, and delete SSO users, as well as fine-tune access for each user per service directly through the portal. For more information on what SSO is and what benefits it provides, see [SSO Access](/docs/ca/dev/access/sso-access.html). ## Capabilities - **Identity provisioning:** Create SSO users for specific environments to ensure precise access control. - **Secure connectivity:** Enable or disable VPN access for individual users to secure communications with protected network resources. SSO users also offer a number of options for securing your access from MFA to passwordless. - **User lifecycle management:** Modify existing user configurations or remove users when access is no longer required. ## Available service permissions Users can be assigned very granular permissions for every available application per environment. This means one SSO user can have admin permissions for RabbitMQ on a test environment and viewer permissions for RabbitMQ on a production environment. | Service | Permission | | -------- | -------- | | RabbitMQ | * Admin — Full administrative access with the ability to create and remove queues
* Developer — Can view queues, read and publish messages in the queues
* Viewer — Read-only access to queues | | Jenkins | * Admin — Full administrative access
* Developer — Can build, view, and cancel jobs
* Viewer — Read-only access to jobs and builds | | AWS CLI | * BaseRole — Allows access to the specific environment in the AWS Dashboard and AWS CLI
* Custom Role — Can be absent, or can be one or more roles composed specifically for the customer that include all permissions of the Base role and additional permissions like DB access | ### Requesting and renewing VPN for your SSO user An SSO user needs VPN to access Jenkins and RabbitMQ. No VPN is required to access AWS Console. To request the VPN for the specific environment, select the VPN option in the SSO user creation or edit form on CloudHub. Depending on whether SSO is enabled for Bastion (which handles VPN connections), you may need to use your SSO user credentials to also log in to the VPN when turning it on. If your VPN configuration has expired, click the **VPN Renew** button next to your user to request a new VPN configuration. ## Credential delivery for new users When a new SSO user is created, credentials and access configuration are delivered securely across two separate emails: 1. **User update email:** You will get an `Action needed: Verify your Spryker SSO account updates` email with the link for account update. Follow this link to set up the password for your new user. 2. **VPN configuration email:** If you selected the VPN checkbox on user creation, or checked it during user edit, the VPN configuration file (OVPN profile) required to connect to the protected network is sent in a separate email. {% info_block infoBox "Security note" %} Keep both emails secure. The link for account update expires in 3 hours. If you did not manage to set up the user password within 3 hours, contact support. {% endinfo_block %}

SSO Security Options

Fri, 10 Jul 2026 11:14:34 +0000

{% info_block infoBox %} This feature is part of a gradual rollout and will be available to everyone eventually. We will notify your team once your project is onboarded. {% endinfo_block %} ## Security benefits of the SSO access From a security perspective, enabling SSO strengthens the existing secure access flow by adding additional protection layers: - Secure VPN access - TLS communication - Various authentication options Users can authenticate through: - **Flexible authentication:** Authenticate users with various mechanisms, including passkey and your own identity provider. - **Two-factor authentication:** Support for passkey, recovery codes and TOTP/HOTP via Google Authenticator or FreeOTP. ## Passkey (WebAuthn authenticator) A passkey is a FIDO authentication credential based on FIDO standards that allows a user to sign in to apps and websites with the same process that they use to unlock their device (biometrics, PIN, or pattern). Passkeys are FIDO cryptographic credentials that are tied to a user's account on a website or application. {% info_block infoBox "Acquiring Passkey limitation" %} This feature is available only for SSO users created via a Self-Service request. Users managed through External IdP connections are not supported. {% endinfo_block %} How to set up a passkey for your SSO user: 1. Click on **Keycloak** service in CloudHub which will lead to the SSO login page. 2. Log in to your Keycloak Account Console. 3. Go to the **Account Security** section. 4. Open **Signing In**. 5. Find the **Passkey** section. 6. Click **Set up passkey**. 7. Follow the browser prompt to create a passkey using your device's supported method (for example, Windows Hello, Touch ID, Face ID, security key). 8. After successful registration, the passkey appears in your list of registered authenticators. ### Authenticate with WebAuthn authenticator After you register your authenticator, signing in is easy: 1. Open the login page and enter your username and password. 2. Your browser will prompt you to verify your identity using your authenticator (for example, fingerprint, face recognition, or security key). ## LoginLess (WebAuthn passwordless) Log in without a username or password. You can sign in using biometric methods (such as fingerprints or facial recognition), FIDO2 security keys (for example, YubiKey), or other compatible authenticators. {% info_block infoBox "Acquiring LoginLess limitation" %} This feature is available only for SSO users created via a Self-Service request. Users managed through External IdP connections are not supported. {% endinfo_block %} 1. Click on **Keycloak** service in CloudHub which will lead to the SSO login page. 2. Log in to your Keycloak Account Console. 3. Go to the **Account Security** section. 4. Open **Signing In**. 5. Find the **Passwordless** section. 6. Click **Set up passkey**. 7. Follow the browser prompt to create a passkey using your device's supported method (for example, Windows Hello, Touch ID, Face ID, security key). 8. After successful registration, the passkey appears in your list of registered authenticators. ### Authenticate with LoginLess (WebAuthn passwordless) If you have set up passwordless WebAuthn, you can sign in to Keycloak without entering a username or password. You will simply confirm your identity using your device (such as fingerprint, face recognition, or a security key). WebAuthn can also be used as an extra security step (two-factor authentication) if enabled for your account: 1. Open the login page. 2. Click **Sign in with Passkey**. 3. Your browser will prompt you to verify your identity using your authenticator (for example, fingerprint, face recognition, or security key). ## Related topics - [User Management SSO](/docs/ca/dev/cloud-hub/sso-user-management.html)

SSO Access

Fri, 10 Jul 2026 11:14:34 +0000

{% info_block infoBox %} This feature is part of a gradual rollout and will be available to everyone eventually. We will notify your team once your project is onboarded. {% endinfo_block %} ## What is SSO **Single Sign-On (SSO)** is an authentication mechanism that allows users to sign in once and access multiple applications without re-authenticating for each service (RMQ, Jenkins). SSO can be integrated with an external organizational identity provider (IdP), such as a corporate directory service, enabling centralized user management and access control. This approach improves security by reducing password reuse and enhances the user experience by minimizing repeated logins. ## How SSO improves the user experience SSO makes accessing services easier, faster, and more secure by providing: - **Centralized authentication** through your company's identity provider, or via users managed in our identity system - **Fewer passwords to remember**, reducing friction and support overhead - **A faster and smoother login experience** across all connected services - **Simplified user lifecycle management** (onboarding, updates, and offboarding) - **Stronger security and compliance** through consistent authentication policies - **Easy integration for enterprise organizations** that use their own identity provider ## How to access applications with an SSO user You will need an SSO user, [User Management SSO](/docs/ca/dev/cloud-hub/sso-user-management.html) describes how to get one. ### AWS access #### AWS Management Console 1. Click on **AWS Console** service in CloudHub which will lead to the SSO login page. 2. Log in using your SSO user credentials. 3. After successful authentication, you will be redirected to the AWS Management Console with access to your environment services. #### AWS CLI To access AWS services via the AWS CLI with your SSO credentials, see [Connecting to AWS CLI with an SSO user](/docs/ca/dev/access/connecting-to-aws-cli-with-an-sso-user.html). ### VPN access VPN access uses short-lived sessions for improved security. To start a VPN session, you must go through the SSO login process and provide an MFA code. 1. Open your VPN client and initiate a connection to the target environment. 2. When prompted, log in using your SSO user credentials. 3. Provide your MFA code to complete authentication. 4. Once authenticated, the VPN session is established. The session is short-lived and will expire after a period of inactivity or at a set time limit. To reconnect after a session expires, repeat the SSO login and MFA steps. ### RabbitMQ access For RabbitMQ, the user must have VPN enabled for the specific environment they want to access. Once the VPN is enabled: 1. Click on **RabbitMQ** service in CloudHub which will lead to the RabbitMQ login page. 2. Click the **Log in** button. 3. You will be redirected to the SSO login form. 4. Provide your SSO user credentials and log in. If you previously logged in to VPN or any other application in the same browser, for example Jenkins, log in happens automatically, because you are using the same SSO user. ### Jenkins access For Jenkins, the user must have VPN enabled for the specific environment they want to access. Once the VPN is enabled: 1. Click on **Jenkins** service in CloudHub which will lead to the SSO login page. 2. Provide your SSO user credentials and log in. 3. You will be redirected to the Jenkins dashboard. If you previously logged in to VPN or any other application in the same browser, for example RabbitMQ, log in happens automatically, because you are using the same SSO user. ### Keycloak access Keycloak is where you can view and edit your SSO user profile (editing options are limited). 1. Click on **Keycloak** service in CloudHub which will lead to the SSO login page. 2. Provide your SSO user credentials and log in. 3. You will be redirected to Keycloak where you can change your username and password. If you previously logged in to VPN or any other application in the same browser, for example RabbitMQ, log in happens automatically, because you are using the same SSO user. ## External IdP connection As an alternative or additional authentication method, we support connection to external Identity Providers (IdPs) that use SAML or OpenID Connect (OIDC). Benefits of using an external IdP: - You can apply and enforce your own authentication policies. - You can manage user assignments and permissions to all supported services directly through your IdP without creating any Self‑Service requests. - Centralized lifecycle management of users (onboarding/offboarding handled entirely in your IdP). - Stronger security posture through enterprise-grade features such as MFA, conditional access, and device or network policies. - Seamless user experience with a single set of corporate credentials. - Reduced administrative overhead by eliminating duplicate user management. - Better compliance and auditing through centralized identity logs and policies. - Faster and automated access provisioning as your organization scales. - Improved security posture by not storing or processing passwords within our platform. {% info_block infoBox "Acquiring external IdP users limitation" %} Such users **cannot** be created or managed via CloudHub User Management (SSO) page. For configuration details, contact our support team. {% endinfo_block %} ## Next steps - [User Management SSO](/docs/ca/dev/cloud-hub/sso-user-management.html) - [SSO Security Options](/docs/ca/dev/access/sso-security-options.html) - [Connecting to AWS CLI with an SSO user](/docs/ca/dev/access/connecting-to-aws-cli-with-an-sso-user.html)

Service links

Fri, 10 Jul 2026 11:14:34 +0000

The **Service Links** panel in [CloudHub](/docs/ca/dev/cloud-hub/cloud-hub.html) provides quick access to the services available in each of your target environments. Each service is displayed as a card with a direct link to open it. {% info_block infoBox %} This feature is part of a gradual rollout and will be available to everyone eventually. We will notify your team once your project is onboarded. {% endinfo_block %} {% info_block infoBox "SSO access only" %} Service links are only available for SSO-enabled environments. For non-SSO environments, links are not working as the URLs differ. {% endinfo_block %} ## Accessing service links To access service links, do the following: 1. In CloudHub, go to **Service Links**. 2. In the top-right corner, select the target environment from the dropdown. 3. The panel displays all available services for the selected environment. 4. To open a service, click **Open** on the corresponding service card. ## Available services The following services may be available depending on your environment configuration: | Service | Description | VPN required | | :--- | :--- | :--- | | **Jenkins** | Provides access to the Jenkins dashboard for managing build and deployment pipelines. | Yes | | **RabbitMQ** | Lets you monitor queues, exchanges, and message activity. | Yes | | **AWS Console** | Provides access to the AWS Management Console for your environment. | No | | **KeyCloak** | Lets you manage users, roles, and authentication settings. | No | {% info_block warningBox "VPN requirement" %} Jenkins and RabbitMQ are only accessible when your VPN connection is active. Make sure your VPN is connected before attempting to open these services. For instructions on setting up VPN access, see [User management (IAM)](/docs/ca/dev/cloud-hub/user-management.html). {% endinfo_block %} {% info_block infoBox "Environment availability" %} The services shown depend on the selected environment and may vary. Note that this page displays all services available in that environment — it does not reflect the access granted to individual users. {% endinfo_block %}

Connecting to AWS CLI with an SSO user

Fri, 10 Jul 2026 11:12:34 +0000

This feature is part of a gradual rollout and will be available to everyone eventually. We will notify your team once your project is onboarded.

This document describes how to configure and use SAML2AWS to authenticate with the AWS CLI using your SSO credentials.

SAML2AWS is a command-line tool that lets you authenticate against an identity provider (IdP) using SAML and obtain temporary AWS credentials. This gives you AWS CLI access to your cloud environment without managing long-lived AWS access keys.

Prerequisites

SAML2AWS installed on your machine.
AWS CLI installed on your machine.
An SSO user. See User Management SSO.
Your SSO login page URL. To get it, see SSO Access.

Step 1: Configure SAML2AWS

To configure SAML2AWS, replace the placeholders with your actual values and execute the following:

saml2aws configure \
  --idp-provider=Browser \
  --browser-type={BROWSER_TYPE} \
  --url={YOUR_SSO_LOGIN_PAGE_URL} \
  --profile={YOUR_PROFILE} \
  --skip-prompt

Parameter	Description
`--idp-provider=Browser`	Uses a browser-based login flow via your identity provider.
`--browser-type`	The browser to use for authentication. See Supported browser types.
`--url`	SSO login page URL.
`--profile`	The AWS CLI profile name to store credentials under.
`--skip-prompt`	Skips interactive prompts and applies values directly.

Example:

saml2aws configure \
  --idp-provider=Browser \
  --browser-type=chrome \
  --url=https://auth.spryker.systems/realms/my-realm/protocol/saml/clients/my-aws-client \
  --profile=my-aws-profile \
  --skip-prompt

Step 2: Log in with SAML2AWS

After configuring, run the login command to authenticate and retrieve temporary AWS credentials:

saml2aws login \
  --profile={YOUR_PROFILE} \
  --skip-prompt

Add --force to skip the expiry check and re-authenticate even if existing credentials are still valid:

saml2aws login \
  --profile={YOUR_PROFILE} \
  --skip-prompt \
  --force

Browser driver

On some operating systems and browsers, SAML2AWS needs to download a browser driver automatically. If login fails or the browser does not open, add the --download-browser-driver flag:

saml2aws login \
  --profile={YOUR_PROFILE} \
  --download-browser-driver \
  --skip-prompt

You do not need this flag if you are on Linux and using Chrome.

On successful authentication, your terminal displays a confirmation and the credentials are saved under the specified profile.

Step 3: Use the AWS CLI

Pass --profile {YOUR_PROFILE} to any AWS CLI command to use the credentials obtained from SAML2AWS:

aws --profile={YOUR_PROFILE} s3 ls
aws --profile={YOUR_PROFILE} ec2 describe-instances

To avoid specifying --profile with every command, set the AWS_PROFILE environment variable for your session:

export AWS_PROFILE={YOUR_PROFILE}
aws s3 ls
aws ec2 describe-instances

The temporary credentials expire after a set period. When they expire, re-run the login command from Step 2 to refresh them.

Supported browser types

The --browser-type parameter accepts the following values (see the full list in the saml2aws source):

Value	Browser
`chrome`	Google Chrome (stable)
`chrome-beta`	Google Chrome Beta
`chrome-dev`	Google Chrome Dev
`chrome-canary`	Google Chrome Canary
`chromium`	Chromium
`firefox`	Mozilla Firefox
`webkit`	WebKit (Safari engine, macOS)
`msedge`	Microsoft Edge (stable)
`msedge-beta`	Microsoft Edge Beta
`msedge-dev`	Microsoft Edge Dev
`msedge-canary`	Microsoft Edge Canary

OS and browser combinations

The following combinations have been verified to work:

Operating system	Browser
Ubuntu	Chrome, Chromium, Firefox
macOS	WebKit, Chromium
Windows 10	Chrome, Firefox, Microsoft Edge

Chrome on macOS

Chrome on macOS may not work for all users. If you experience issues, use webkit or chromium instead.

Troubleshooting

Issue	Solution
The browser does not open during login.	Add `--download-browser-driver` to the login command to let SAML2AWS download the required browser driver automatically.
Authentication fails or credentials are not saved.	Verify that `--browser-type` matches a browser installed on your machine and that the `--url` value is correct.
The AWS CLI does not recognize the profile.	Ensure the `--profile` value in the login command matches the one used during configuration.
`Error authenticating to IDP.: please install the driver (vx.x.x) and browsers first: %!w(<nil>)`	Add `--download-browser-driver` to the login command to let SAML2AWS download the required browser driver automatically.

Next steps

Search Statistics

Fri, 10 Jul 2026 09:29:49 +0000

Search Statistics is a Back Office feature that gives business operators visibility into storefront search behavior. It uses Google Analytics 4 (GA4) as the underlying data collection and reporting layer, eliminating the need for custom per-project analytics implementations. {% info_block warningBox "Legal compliance" %} Search Statistics collects storefront search queries by using Google Analytics 4. To comply with privacy regulations such as the GDPR and ePrivacy Directive, inform storefront customers about this data collection. Update your cookie consent banner and privacy policy to explain that the search terms customers enter are collected and processed for analytics purposes. Obtain customer consent before you enable tracking. {% endinfo_block %} ## Related developer guides - [Install Search Statistics](/docs/pbc/all/miscellaneous/latest/third-party-integrations/marketing-and-conversion/analytics/google-analytics/install-search-statistics.html) ## Use Search Statistics This section explains how to use Search Statistics in the Spryker Back Office. Search Statistics shows what customers are searching for and which searches return no results, so you can optimize your catalog, create synonyms, and improve product discoverability. {% info_block infoBox "Data availability" %} Google Analytics 4 processes incoming events with a delay of up to 48 hours. Search data collected on the storefront may not appear in the Back Office immediately after installation. {% endinfo_block %} ### Access Search Statistics To open the Search Statistics dashboard, in the Back Office, go to **Analytics > Search Statistics**. The dashboard displays the following: - **Top 10 Frequent Searches**: the ten most searched terms for the selected period, ranked by search count. - **Top 10 Zero-Result Searches**: the ten most frequently searched terms that returned no results, ranked by occurrence count. ### Select a date range The dashboard and all detail views filter data by a date range. The currently active range is shown at the top of the page. To change the date range, select the date range dropdown and choose one of the following options: - **Last 24 hours** - **Last 7 days** - **Last 30 days** - **Custom range**: opens a date picker where you can set a start and end date. ### Analyze frequent searches The **Top 10 Frequent Searches** widget shows the most popular search terms. Use this data to: - Understand buyer intent and prioritize catalog improvements. - Identify high-volume terms to optimize product titles and descriptions. - Discover seasonal or campaign-driven search trends. To view all frequent searches beyond the top 10, click **View All**. The detail page shows a full list with the following columns: | COLUMN | DESCRIPTION | | ------------- | ----------------------------------------------------------------- | | Search Term | The query customers entered. | | Store | The store in which the search term was searched. | | Locale | The locale in which the search term was searched. | | Search Count | The number of times the term was searched during the selected period. | | Last Occurred | The date when the term last occurred. | On the detail page, you can: - **Sort** the list by the **Count** column. - **Filter** by date range using the date picker at the top of the page. - **Filter** by store using the store select at the top of the page. - **Filter** by locale using the locale select at the top of the page. - **Paginate** through results using the controls at the bottom of the list. ### Identify zero-result searches The **Top 10 Zero-Result Searches** widget shows the most frequently searched terms that returned no results. Use this data to: - Create synonyms for terms that do not match existing product data. - Identify gaps in the product catalog to fill with new products. - Improve search relevance by adjusting search configuration. To view all zero-result searches, click **View All**. The detail page shows a full list with the following columns: | COLUMN | DESCRIPTION | | --- | --- | | Search Term | The query that returned no results. | | Store | The store in which the search term was searched. | | Locale | The locale in which the search term was searched. | | Occurrence Count | The number of times customers searched for this term with zero results. | | Last Occurred | The date when the term last occurred. | On the detail page, you can: - **Sort** the list by the **Count** column. - **Filter** by a minimum occurrence threshold to focus on high-impact terms. - **Filter** by date range using the date picker at the top of the page. - **Filter** by store using the store select at the top of the page. - **Filter** by locale using the locale select at the top of the page. - **Paginate** through results using the controls at the bottom of the list. ### Limitations - **Data delay**: Search events collected on the storefront appear in the dashboard after up to 48 hours of GA4 processing time. - **Ad blockers**: Customers with ad blockers installed may not send events to GA4. This can cause search data to be underreported by an estimated 10–25%.