Configuration
These eight values are the whole configuration surface. Each can be entered in RedeemID → Settings or defined as a constant of the same name in wp-config.php:
- Settings is the easy start. Values are saved in the options table (
redeemid_config). Secrets are encrypted before they are stored (libsodium, keyed fromREDEEMID_ENCRYPTION_KEYor the WordPress salts), are write-only (the field is always blank; leave it blank to keep the saved value) and are never shown again. - A constant always wins. Its field in Settings is locked and says which constant sets it. This is the more secure choice: the value never touches the database, so a database dump or a compromised admin account can’t reach it. Move a value to
wp-config.phpwhenever you are ready; the saved copy is then ignored.
Changing the WordPress salts or REDEEMID_ENCRYPTION_KEY makes secrets saved in Settings unreadable. Settings, Debug and the Health block then say so, and the secret has to be entered again. REDEEMID_ENCRYPTION_KEY itself is constant-only. RedeemID → Debug shows where each value comes from, never the value.
| Constant | Required | Purpose |
|---|---|---|
REDEEMID_STORE_DOMAIN |
yes | your-store.myshopify.com |
REDEEMID_CLIENT_ID |
yes | Customer Account API client ID. Powers sign-in. |
REDEEMID_CLIENT_SECRET |
confidential clients | Customer Account API client secret. Leave unset for a public client. |
REDEEMID_ADMIN_CLIENT_ID |
yes | Client ID of the Dev Dashboard app installed on the store. Powers resync, tag editing and webhook registration. |
REDEEMID_ADMIN_CLIENT_SECRET |
yes | That app’s client secret. The plugin uses it to request 24-hour Admin tokens (client credentials grant) and to verify the app’s webhooks. |
REDEEMID_PUBLIC_ACCESS_TOKEN |
for plan cards | Storefront API public token from the Headless channel. Powers plan cards and buy-now. Public by design. |
REDEEMID_STOREFRONT_PRIVATE_TOKEN |
recommended | Storefront API private token from the same Headless channel. When set it replaces the public token for every Storefront call, and buy-now and cart calls send the buyer’s IP (Shopify-Storefront-Buyer-IP), as Shopify asks of server-side callers. Without it every visitor looks like your server’s one IP, so Shopify may throttle checkout creation. |
REDEEMID_ENCRYPTION_KEY |
no | Base64 32-byte key for token encryption. By default a key is derived from the WordPress salts. Set this if you rotate salts. |