Reconnect and disconnect

Both are on Stores › Settings › Conviro Setup (admin permission Conviro_AiChat::setup). A store can also be disconnected from the Conviro dashboard (Magento card). Plan §13, §1.4 "Can I disconnect safely?". Code: AiChat/Service/Connection/{Disconnector,ConnectionState,StoreRegistration,ReconnectPolicy}.php, AiChat/Observer/ConfigSaveAfter.php, backend MagentoService.disconnectStore and MagentoConnectService.{disconnect,assertRegistrationAllowed}. Measured on the local stack against the mock Conviro (setup-wizard.sh, connect-lifecycle.sh), including a disconnect while Conviro is down, the cron retry and the key revocation; not yet against the real backend. Updated 2026-09-25 for release gate R3 and the security review (ceaaac4d, c26b8965 and 8791cdc4).

Disconnect from Magento

Conviro is told first (while the API key still exists), then the store cleans up locally — always, even if Conviro cannot be reached. Running it twice is harmless.

The confirmation box has a second checkbox, Keep the chat widget on my storefront, unticked by default:

unticked — Disconnect also switches the storefront chat widget and the lead form off (conviro_aichat/general/widget_off_since records when; the page caches are cleaned so shoppers stop seeing it at once). Your widget settings are kept; a Reconnect switches it back on.
ticked — the widget keeps working (it talks to Conviro with its public key). To remove it later set Enable = No or clear Widget Public Key.

What Conviro does (`POST /api/magento/disconnect-store`)

Removed or stopped	Detail
Store credentials	Every Magento integration row of the workspace is set inactive and its stored credentials are replaced by `{}`: OAuth consumer/token secrets, the legacy bearer token and the signing secrets are gone. The time and origin ("from the Magento admin") are recorded.
Live reads	Conviro stops reading the store; cached live reads (products, stock, prices, orders, profiles, carts, …) are dropped.
Product knowledge	The workspace's Magento product knowledge-base entries are deactivated (the assistant stops using them; the rows are not deleted).
Webhooks to the store	The store's receive webhook is switched off and its secret overwritten.
Cart recovery	Scheduled, unsent recovery e-mails are cancelled.
API key	The key the store used is *revoked if the wizard's Connect to Conviro* created it**. A key you pasted by hand is not revoked — revoke it in Conviro › Developers › API Keys if you no longer need it.
Audit	`magento.disconnected` in the workspace audit log.

Kept at Conviro for 30 days, then deleted unless the store reconnects (security review R3, 2026-09-25): the store's commerce_orders, commerce_customers, commerce_checkouts, commerce_payment_failures and commerce_sync_jobs rows — and, once no Magento store is connected to the workspace, its cart-recovery rows and product-link ids. The daily retention job deletes them and writes magento.store_data.purged (counts only) to the workspace audit log. To delete them at once, use Delete store data now on the Magento store card in the Conviro dashboard (owners and admins, confirmed, audited as magento.store_data.deleted).

Kept at Conviro (Disconnect does not delete them): conversations and their grounding records, AI action requests and audit log, leads created from registrations, contacts and the deactivated knowledge-base rows. For deletion of this data see the privacy page and Conviro's DPA.

What Magento does

Removed or stopped	Detail
Magento integration	"Conviro AI Chat" is set inactive and its OAuth access token deleted, so the credentials Conviro held stop working at once. The integration and its consumer stay, so Reconnect can re-activate it.
Settings	`general/api_key`, `general/webhook_secret`, `general/event_secret`, `general/receive_secret`, `general/auth_mode`, `general/oauth_error` are deleted.
Storefront widget	Switched off unless Keep the chat widget on my storefront was ticked (above).
Event queue	Every undelivered event (pending, sending, held, failed) becomes `dropped`, and every stored payload in the outbox is emptied — including delivered ones — because they carry customer data that will never be sent. Rows stay as the delivery log (event id, type, store, subject, status, times) and are purged on the usual schedule.
Sync jobs	Every running job is stopped ("the store was disconnected").
OAuth migration	A pending automatic migration is cancelled.

Kept in Magento: workspace and chatbot ids, the widget public key and widget settings, sync toggles, store-view selection, sync plan and AI capabilities — so Reconnect restores the same setup.

When Conviro cannot be reached

The local disconnect completes; the Conviro call is queued. The old API key is kept encrypted in Magento's flag table only for this retry; cron (conviro_connection_maintenance) retries after 1 min, 5 min, 15 min, 1 h, then every 6 h, and gives up after 7 days (the health card then says to disconnect in the Conviro dashboard as well). If Conviro answers 401/403 the key was already revoked or lacks the scope — also finish in the dashboard. The queued call is dropped as soon as the store reconnects, so it can never disconnect the new connection.

The Integration Health verdict then reads "Disconnected from Conviro on <date> UTC — nothing is sent and Conviro no longer reads this store" (a Warning).

Disconnect from the Conviro dashboard

Owner or admin, Magento card › Disconnect. Conviro does everything in the first table above and revokes every still-active key the connect flow minted for the workspace (release gate R3; a key you pasted by hand is left alone). Magento is not told: its health card shows Action required on the Authentication row ("Conviro has this store as disconnected …", or the key is rejected) with Reconnect as the fix. Events the store sends meanwhile are refused and held (blocked) until it reconnects. The storefront widget is not changed by a dashboard disconnect.

A disconnected store reconnects only on purpose

Security review (release gate R3): once a store is disconnected, only an explicit act connects it again.

Conviro (register-store) refuses a disconnected store with 409 store_disconnected unless the calling API key was created after the disconnect — a new connect code (wizard Reconnect) or a key you created and pasted afterwards. So a Save Config with the key the store already held, or the automatic OAuth migration of an upgraded 1.3.x store, does nothing; the admin sees "This store was disconnected from Conviro … click Reconnect", and the migration stops (failed).
Magento does not even try from a config save while it has the store as disconnected, unless that save changed the API key.
A key minted by the connect flow registers only the store it was approved for (403 key_bound_to_other_store for another store URL).

Save Config

Saving Stores › Configuration › Conviro › AI Chat re-registers the store with Conviro when an API key is saved (and the store is not disconnected, above): the OAuth credentials are sent again — the access token is reused, never regenerated — together with the current AI capabilities; events held on the old credentials are released. Until 1.4.0 this did not happen at all: the observer listened to admin_system_config_changed, an event Magento never dispatches (core dispatches admin_system_config_changed_section_<section>); 1.4.0 listens to admin_system_config_changed_section_conviro_aichat. Measured (connect-lifecycle.sh): a real admin config save registers the store, a second save sends the same access token.

Reconnect

Setup wizard › Reconnect runs steps 2 and 3 again (browser approval, then the OAuth registration) with the saved store-view selection, sync choices and AI permissions. On reconnect:

Conviro clears the disconnect and switches its receive webhook to the store back on (a webhook you switched off by hand stays off);
the store-view mapping is sent again;
the storefront widget comes back if Disconnect had switched it off;
events held for credentials are re-queued; dropped events are not (use Repair failed items to rebuild what can be rebuilt, and Re-sync for a full refresh).

A connected store whose key is still valid can also be re-registered with Save Config (above).