Frequently Asked Questions

FFL Bridge lets firearm retailers add FFL dealer selection to online checkout, so buyers search by ZIP code and choose the dealer that will receive their order. It comes as a REST API, an embeddable browser widget, and a WooCommerce plugin.

WooCommerce has a maintained plugin. Other storefronts can use the REST API, or the browser widget where the platform allows custom JavaScript at checkout, so confirm your platform permits that customization before choosing the widget.

No. FFL Bridge is built for online firearms retailers and e-commerce platforms. You don't need your own FFL to use the API. Your customers use it to find a licensed dealer near them to receive their purchase.

The Free plan includes 100 API calls a day and stops at that limit. Paid plans are Starter at $15/mo for 1,000 calls a day, Growth at $49/mo for 10,000, and Pro at $99/mo for 100,000. On paid plans, server-key calls over the daily allowance cost $0.005 per call, while browser-key calls always stop at the allowance and never create overage charges.

No. The FFL Bridge Free plan does not require a credit card.

No. Plans are priced by total daily API calls across your account, not by the number of sites, so there is no per-site fee. Each API key can list up to 10 allowed domains.

Yes. No contracts, no cancellation fees. Cancel from your dashboard and you'll retain access through the end of your billing period.

Install it from WordPress.org: in WordPress, go to Plugins > Add New Plugin, search for "FFL Bridge for WooCommerce" (listing at wordpress.org/plugins/ffl-bridge-for-woocommerce), and install it. To use the direct file instead, download the 1.2.1 ZIP from fflbridge.com/woocommerce-ffl-plugin and upload it under Plugins > Add New Plugin > Upload Plugin. Activate the plugin while WooCommerce 10.8 or newer is active. Then open WooCommerce > FFL Bridge, enter your API key, check the dealer selection mode (new installs start in Hybrid), choose the product categories that need a dealer, and run the connection and coverage test with a ZIP code your customers use. Place a test order on a staging site before going live.

You need an FFL Bridge account and a server API key (it starts with ffl_live_). The plugin calls FFL Bridge from your server, so the key needs no domain. Your site needs WordPress 6.9 or newer, PHP 8.3 or newer, and WooCommerce 10.8 or newer. You create the account and verify your email, and onboarding shows your first server key only once.

Yes. The FFL Bridge plugin supports both classic WooCommerce checkout and the WooCommerce Checkout Block.

Hybrid is the dealer selection mode that new installs of the FFL Bridge WooCommerce plugin start in. It lists verified network dealers first, labeled "Confirmed transfer dealer", and also lets shoppers choose nearby ATF-listed dealers labeled "License not verified" or "Transfer not confirmed", so shoppers still have options where network coverage is thin. Dealers that have told FFL Bridge they do not accept transfers are never shown. Existing installs keep their saved setting and see an offer to switch, and stores that want only verified dealers can choose "Confirmed dealers only" mode in the plugin settings.

"Confirmed transfer dealer" means the dealer is in the FFL Bridge verified checkout network. "License not verified" means the dealer confirmed transfers with FFL Bridge but its current license copy has not been verified. "Transfer not confirmed" means FFL Bridge has no transfer acceptance on record for that dealer.

Checkout continues, and the customer is asked to contact the dealer, confirm it will accept the transfer, and have the dealer email or fax a copy of its current FFL to your store. The same instructions appear on the order confirmation page, in My Account, and in customer order emails. You choose the email address for license copies (the site admin email by default) and an optional fax number.

Open the order and click "Mark transfer confirmed", optionally attaching the dealer's license copy as a PDF, JPG, or PNG up to 5 MB. The plugin records who confirmed it and when, adds an order note, and stores the file privately. The plugin never contacts dealers on its own.

No. The dealer is saved as order details, and your team follows its own shipping and dealer coordination process.

Only what dealer search and confirmation need: the shopper-entered ZIP code and search radius, your store's site address, your API key, and dealer identifiers. When your staff mark a transfer confirmed, it also sends the dealer's license number, the order number, and any optional staff note or license copy. It does not send shopper names, email addresses, billing or shipping addresses, or payment details.

New dealer searches and dealer checks cannot complete until the service is back. The plugin does not skip a required dealer selection while FFL Bridge is unavailable.

If you ever used version 1.0.x, revoke every API key used with it and create a new one, because 1.0.x sent the API key to the checkout browser and upgrading cannot invalidate a key that was already exposed. Enter the replacement key under WooCommerce > FFL Bridge, or in the FFL_BRIDGE_API_KEY constant in wp-config.php.

Version 1.2.1 is a security hardening release: every admin action and AJAX request now checks both a nonce and the user's permissions, and saving settings requires WooCommerce management permission. Admin notices now appear only on the plugin's settings page and the WooCommerce order screens.

No. The current WooCommerce plugin keeps your FFL Bridge API key on your server and never sends it to the browser. If you use the widget instead, it runs on a separate browser key that works only on the storefront domains you add and can only search dealers.

Include your API key in the Authorization header as "Bearer YOUR_KEY" or in the X-API-Key header. API keys are never accepted in a query parameter.

Yes. One API key can list up to 10 allowed domains, or you can create a separate key for each site: Starter and higher plans include multiple API keys, with up to 5 active keys per account. Browser keys work only on the domains you add. Server keys need no domain; restricting one to a domain list is optional and done only through the /api/v1/domains API. There's no per-site fee; usage is metered by total API calls across all your keys, not by how many sites you run.

You can search by ZIP code, city/state, or exact lat/lng coordinates. Additional filters include radius (default 25 miles), limit (number of results), and whether the dealer accepts transfers.

Search covers both the nationwide ATF directory and the much smaller FFL Bridge verified checkout network, and each result is labeled with the network it belongs to. To return only dealers that can be selected at checkout, add checkoutOnly=true to the API request, or data-checkout-only="true" on the widget.

The widget supports maintained dark and light themes. For a fully custom presentation, use the REST API and render the selection interface in your own storefront.

Search uses geographic pre-filtering and distance calculations, but FFL Bridge does not publish an unverified latency guarantee. Measure the preview and production API from your own storefront region before setting a checkout performance budget.

FFL Bridge is deployed on managed application and database infrastructure. Any contractual availability commitment must be documented in a signed service agreement; the public plans do not currently advertise an uptime SLA.

Dealer search through the widget or the API receives only the search itself, such as a ZIP code, city and state, or coordinates, plus search filters, and returns dealer results. Searches do not ask for shopper names, email addresses, billing or shipping addresses, or payment details. If your server creates orders through the API, each order includes the shopper's name and email address, an optional phone number, and the selected dealer, so the order can be recorded and confirmation emails sent. API call logs record the endpoint, query parameters, IP address, and user agent for usage tracking.

ATF records do not say which dealers accept transfers, so FFL Bridge marks a dealer as accepting transfers only after that dealer confirms it with FFL Bridge.

Monthly. We pull the latest ATF FFL records and reconcile them against our database. Expired, revoked, or surrendered licenses are automatically deactivated.

Yes. Dealers can register on FFL Bridge to claim their profile, add transfer fees, update contact info, and mark whether they accept public transfers. Claimed profiles are verified against ATF records.

Use the contact form or email us at support@fflbridge.com. We'll verify against ATF records and update our database. Dealers can also claim their listing to manage their own information.

FFL Bridge is a dealer lookup and selection tool, not a compliance platform. The receiving FFL dealer handles the transfer, the Form 4473, and the background check.

Use the contact page for account and integration support. Any response-time or availability commitment must be documented in a signed agreement rather than inferred from the public plans.

Yes. Full API docs with endpoints, parameters, response schemas, and code examples are available at fflbridge.com/docs.