Magento 2 + Noli: guide for the agency.

What Noli does in the store

• Reads over the REST API every 5 minutes: orders, invoices, shipments, credit memos, customer groups and websites.
• Creates only single-use cart price rules with a coupon when a customer activates a reward (named "Noli: …"). If the coupon fails, it deletes the rule it just made.
• Never changes orders, products, customers or configuration.
• The load is small: pages of 100 orders every 5 minutes and two requests per coupon. The order history is read once at the start.

Who does what

1. The Integration in Magento

1. New Integration

   System → Extensions → Integrations → Add New Integration. Name: Noli. Leave Email, Callback URL and Identity link URL empty. Confirm with your admin password.

2. Resources (API tab → Resource Access: Custom)

   Tick exactly these in the tree — nothing else is needed:

   • Sales → Operations → Orders → Actions → View
   • Sales → Operations → Invoices, Shipments, Credit Memos
   • Marketing → Promotions → Cart Price Rules
   • Customers → All Customers and Customers → Customer Groups
   • Stores → Settings → All Stores
3. Activate → Allow

   Save, click Activate next to the Integration, then Allow. Magento shows Consumer Key, Consumer Secret, Access Token and Access Token Secret. Later you find them under Edit → Integration Details.

2. Cloudflare or a firewall

Noli calls /rest/ from changing IP addresses, so an IP allowlist won't work. Every request carries an X-Noli-Key header with a key unique to the store. The merchant copies it from Noli → Settings → Magento (step 2) and sends it to you.

1. Security → WAF → Custom rules → Create rule
2. Edit expression and paste the expression below with the store's key.
3. Action: Skip — All remaining custom rules, Rate limiting rules, All managed rules, Super Bot Fight Mode.
4. Put the rule first in the list and click Deploy.

(starts_with(http.request.uri.path, "/rest/") and any(http.request.headers["x-noli-key"][*] eq "<X-Noli-Key>"))

Another WAF (Sucuri, Imperva, ModSecurity, nginx/Varnish rules): allow requests to /rest/ that carry this header. If nothing sits in front of the store, skip this step.

3. Handing over the keys

• Send the merchant the store URL and the four values through a password manager or an encrypted channel — not in chat or plain email. The merchant pastes them in Noli → Settings → Magento, step 3.
• The URL is the storefront address, e.g. https://www.store.com, including the subfolder if Magento runs in one.

4. Widget script (optional)

The merchant gives you the line from Noli (Settings → Magento, step 5). Paste it under Content → Design → Configuration → the store view → HTML Head → Scripts and Style Sheets and flush the cache in System → Cache Management. Works with Hyvä and Luma.

<script async src="https://app.heynoli.ai/widget/v1/noli-widget.js" data-noli-key="pk_live_…"></script>

With an enforced Content Security Policy, allow https://app.heynoli.ai (script-src, and style-src with 'unsafe-inline') and https://qremotwvbhxqkzmxrqzs.supabase.co (connect-src, img-src).

5. Final test

1. In Noli → Settings → Magento, step 4 shows "Store connected" and a successful sync.
2. Place a test order with the email or phone of a program member, invoice and ship it (state complete). Within 5 minutes the points show on the customer in Noli.
3. Create a credit memo for part of the order — within 5 minutes the points for that part are taken back.
4. Activate a reward from the portal or chat — a "Noli: …" rule appears in Marketing → Promotions → Cart Price Rules with a code that works in the cart.
5. The widget shows on the storefront (if you added the script).

If something doesn't work

To cut access, deactivate or delete the Integration in Magento. More on the Noli side: Magento 2.