Install the Magento module
- Magento Open Source and Adobe Commerce 2.4.4 to 2.4.9
- PHP 8.1 to 8.5
- Module 1.0.8
- Updated on 26 October 2026
- 15 minutes
The Tocsin24 Connector module reads the state of your shop (versions, patches, accounts, code files, logs) and sends it to Tocsin24, read-only: it changes nothing in the shop and sends no secrets. Allow a quarter of an hour: install the module, create the Magento integration, then pair the shop.
On this page
Tocsin24 walks you through the “Installing and pairing the Magento 2 module” step of your instance (you can find it later under Settings › Module). This guide details each step and the messages you might come across.
1. Install the module
Two methods, your choice: with Composer (recommended, updates take a single command) or with an archive to unzip into app/code. Do not use both at once.
With Composer
- In Tocsin24, “Install the module” block, keep the “With Composer” tab and click “Copy the commands”: they contain the username and token that belong to your instance.
- Paste them into a terminal, from the shop’s root folder (the one that contains
bin/magento). They look like this:
The username and token are saved in the shop’s auth.json file: do not add it to the shop’s Git repository.
Without Composer: archive in app/code
- In Tocsin24, “Without Composer” tab, click “Download the Magento module”.
- Upload the archive to the server, then unzip it into
app/code: it creates theapp/code/Tocsin24/Connectorfolder.
If the module was already in app/code and you are moving to Composer, delete that folder first: otherwise Magento finds the module twice.
Enable the module
In both cases, finish with these commands (adjust the static content languages to those of your shop):
In production mode, setup:upgrade empties the static content: that is why it is redeployed before the cache is flushed.
Keep var/tocsin24 across deployments
The module keeps its scan of the code files in var/tocsin24. If your deployments create an empty var/ folder, share this subfolder from one release to the next, like var/log, owned by the PHP user. Otherwise, every deployment forces the module to run a full scan again, and code monitoring is blind until the next scan.
2. Create the Magento integration
The integration gives Tocsin24 read-only access to the module, and to nothing else.
- In the Magento admin, open System › Extensions › Integrations, then “Add New Integration”.
- Name: Tocsin24. In “Your Password”, enter the password of your administrator account (Magento asks for it as a confirmation).
- API tab: set “Resource Access” to “Custom” and tick only Tocsin24 Connector — read state.
- Save. In the list, click “Activate” on the Tocsin24 row, then “Allow”: Magento shows four values, Consumer Key, Consumer Secret, Access Token and Access Token Secret.
- In Tocsin24, enter the API base URL (usually the shop’s address) and paste the four values, then “Save”.
3. Pair the shop
Pairing proves that you manage the shop. The code is used only once.
- In Tocsin24, click “Generate a pairing code”. It lasts one hour.
- In the Magento admin, open Stores › Configuration › Tocsin24 › Connector, “Pairing and security” group.
- Paste the code into “Pairing code”. In “Allowed IP addresses”, enter the platform addresses shown by Tocsin24, one per line. Click “Save Config”. Once saved, the code is shown as
******: it is encrypted, this is normal. - Clean the configuration cache:
- In Tocsin24, click “Verify the pairing”. The instance becomes active and the first scans start.
If your hosting provider filters access to addresses under /rest/ (firewall, anti-bot protection), add the platform IP addresses there too.
Check the version and update
- The installed version is shown at the top of Stores › Configuration › Tocsin24 › Connector, “Module” block. Tocsin24 also shows it under Settings › Module, with the latest published version and an “update available” label when there is one.
- Update with Composer:
composer update tocsin24/module-connector, then the commands from Enable the module. - Update with the archive: download the new archive under Settings › Module, replace the contents of
app/code/Tocsin24/Connector, then run the same commands.
Updating keeps the integration and the pairing: nothing needs redoing in Tocsin24.
Common problems
Composer returns 401 or 403 on app.tocsin24.com
The username or token does not match: copy the first two commands again from Tocsin24 ("Copy the commands" button), they belong to this instance only. Composer access only works for an instance that is being set up, active or paused: a removed instance no longer has it.
"Module 'Tocsin24_Connector' … has been already defined"
The module is installed twice, through Composer and in app/code. Keep a single method: to move to Composer, delete the app/code/Tocsin24/Connector folder, then run bin/magento setup:upgrade again.
"Endpoint not found: the Tocsin24 Connector module (Tocsin24_Connector) is not installed or not enabled"
Check with bin/magento module:status Tocsin24_Connector that the module is enabled, run bin/magento setup:upgrade again, then bin/magento cache:flush. Also check the API base URL entered in Tocsin24: it is usually the shop's address, without /rest or a store code.
"Integration token refused by Magento"
The integration has been reauthorised, recreated or deleted: its four values have changed. In Tocsin24, Settings › Module, open "Update the refused token", paste the four new values, then "Save and verify".
"Access denied: ACL resource missing on the integration, or IP address not allowed by the module"
Check in the integration's API tab that "Tocsin24 Connector — read state" is ticked, and that the module's "Allowed IP addresses" field contains all the addresses shown by Tocsin24. Since version 1.0.7, the module only answers the paired integration: if another integration has been retained instead (message "Seule l'intégration appairée à Tocsin24 peut appeler ce module" in var/log/tocsin24.log), deactivate that other integration; the Tocsin24 one is retained on the next call.
"No pairing code has been entered in the module configuration"
The code is saved but Magento is still serving the old configuration: clean the configuration cache (bin/magento cache:clean config), then click "Verify the pairing" again. Enter the code in the default scope ("Default Config"), not in a website or store view scope.
"The pairing code has expired" or "Too many attempts with this code"
A code lasts one hour and ten attempts. Click "Generate a new code", enter it in Magento in place of the old one, clean the configuration cache, then verify again.
"The declared URL is not among the base URLs configured in Magento"
The API base URL entered in Tocsin24 must be one of the shop's base URLs (Stores › Configuration › General › Web), with the same scheme (https) and the same domain name, www included.
"Too many requests: the hosting provider's web server limits the rate"
A protection in front of Magento (web application firewall, hosting provider's anti-bot service, Cloudflare…) blocks Tocsin24's calls before they reach the shop. Ask your hosting provider to exclude the platform IP addresses listed in Tocsin24 (Settings › Module, "Platform IP addresses") from this protection, at least for addresses under /rest/.
"Instance unreachable (DNS, firewall or timeout)"
Tocsin24 cannot reach the shop: check that the address responds from outside and that no firewall blocks the platform IP addresses. The URL must be public and use https.
Code monitoring starts from scratch after every deployment
Your deployment empties or recreates the var/tocsin24 folder. Share it from one release to the next, like var/log, owned by the PHP user: see "Keep var/tocsin24 across deployments" above.
Need help?
Write to us