Getting started
Install Openfront Ecommerce and create an isolated local store.
This guide follows the current repository scripts and .env.example. It sets up a local evaluation, not a production store.
Prerequisites
- Node.js 20 or newer
- PostgreSQL
- Git and npm
- an empty, isolated database
Clone and install
git clone https://github.com/openshiporg/openfront.git
cd openfront
npm installCreate .env
Copy the checked-in example and replace its placeholders:
cp .env.example .envThe required core values are:
DATABASE_URL="postgresql://username:password@localhost:5432/openfront"
SESSION_SECRET="replace-with-a-random-string-at-least-32-characters"The example also lists SMTP, S3-compatible storage, Stripe, PayPal, OpenRouter, default-region, branding and marketplace-token variables. Configure only the integrations you will test, and keep every real secret out of source control.
Review migrations and start development
npm run devThe current script runs Keystone schema generation, prisma migrate deploy, and the Next.js development server. Review the target DATABASE_URL and migration history before running it.
Create the initial dashboard user
Open /dashboard/init on the local origin if the database has no user, then sign in at /dashboard.
Apply the demo setup
Use the dashboard onboarding flow or the repository's guarded seed command for its intended local runtime. The checked-in seed describes the Impossible Tees store, three regions, products, variants, regional prices, categories, collections and provider records.
Run onboarding twice only on an isolated evaluation database and confirm it reuses stable business keys.
What to check
/redirects or resolves to the configured default country/region storefront./dashboardrequires the expected session and shows the configured store./api/graphqlreflects the generated schema from this exact source.- published products have variants and prices for the region you are browsing.
- cart and order operations reject guessed or mismatched ownership.
- disabled or unconfigured providers fail closed.
Do not use a root HTTP 200 or seeded products as proof that checkout, provider webhooks, refunds, shipping, API-key scopes or OAuth are safe. Test the exact workflow and negative cases you intend to deploy.