FAQ

Short answers to the questions shop owners, developers and procurement teams ask most about punchout.dev, each with a link to the full page.

What is the difference between OCI, cXML and IDS Connect?

All three let a buyer system open your shop and take the cart back. They differ in who uses them. OCI comes from SAP and is used by SAP SRM and SAP S/4HANA. SAP Ariba, Coupa and many other procurement suites use cXML. IDS Connect 2.5 is the standard for craftsman software in German-speaking countries. punchout.dev supports the cart transfer for all three; for cXML, landing on a single item (Level 2) is enabled on request. Buyer systems explains the setup for each system.

Which buyer systems work with it?

Any buyer system that speaks OCI, cXML or IDS Connect. SAP SRM and SAP S/4HANA use OCI. SAP Ariba, Coupa, Jaggaer, Oracle Fusion Procurement and Workday use cXML. Onventis supports both. Craftsman software connects over IDS Connect. See Buyer systems.

Does it work with Shopware, WooCommerce, Magento, Shopify or my own shop?

Yes, with any shop that shows its cart page in a browser. The script tag goes into the layout template; on Shopify, for example, that is the theme file theme.liquid, which you open in the Shopify admin under Online Store → Themes → Edit code. Optional plugins exist for Shopware 6.7, WooCommerce and Magento 2.4. They mark the cart and add auto-login. On other platforms, the guided cart detection finds the cart, and auto-login needs your own login endpoint. See Install the tag, Shop plugins and Your own integration.

Do I need a developer?

Usually not. Whoever can edit the shop’s layout template can paste the script tag. A plugin installs like any other Shopware, WordPress or Magento extension. If your shop sends a Content Security Policy, someone has to add the four lines from the Embed tab to it (see below).

Does the script tag slow down my shop?

Not noticeably. The script loads with async and is under 25 KB gzipped. Without a running punchout it sends nothing and shows nothing, so regular customers never see it. During a punchout it keeps one cookie of its own for at most four hours, and it reads none of the shop’s cookies. The panel brings its own styles, so it does not touch the shop’s design.

What data leaves the shop page, and where is it processed?

Only the content of the cart page during a running punchout, or a page the shop owner sends on purpose during cart detection. Without a punchout, nothing leaves the page. The contents of form fields for passwords, email addresses, phone numbers and card data are left out, and the shop’s cookies are never read. punchout.dev processes the cart page on its own servers, hosted on AWS in Frankfurt, and the data stays in the EU. Details: Security and privacy.

Do you store the carts?

Only while the punchout runs. A punchout and the cart read during it expire four hours after the launch and are then deleted. Afterwards, only daily figures per shop remain, such as sessions and transfers, plus the results of the portal’s test punchouts, which are kept for 30 days. The Live sessions list on the Usage tab shows the buyer, the return host, the status and the number of items of each running punchout, never the cart.

What does the buyer need from me?

A buyer credential and an address, both from the portal. Create the credential on the shop’s Buyers tab; the secret is shown only once. The address is on the Embed tab: OCI launch for SAP, cXML PunchOutSetupRequest for Ariba, Coupa and other cXML systems, IDS Connect Roundtrip-URL for craftsman software. See Connect a buyer.

Can I test without a real buyer?

Yes. The shop’s Setup tab has a Test punchout that runs a real OCI, cXML or IDS Connect punchout against your shop and opens it in a new tab. Put something in the cart and transfer it in the panel; the portal then shows what a buyer system would have received, item by item and as raw fields. Test punchouts work in the Sandbox and do not count against the monthly transfers. See Test punchout.

What happens when my cart layout changes?

With a plugin, nothing: the marker sits in the cart template and moves with it. Without one, a theme update can move the cart out of the container found by cart detection, and the panel then shows “No cart on this page” on the cart page. punchout.dev notices when the cart can no longer be read, and the Usage tab warns “The cart is no longer being found”. Run the cart detection again from the Setup tab. See Cart detection.

Which languages does the panel speak?

German and English. The panel follows the lang attribute of the shop page, or the browser’s language when the page has none: German when it starts with de, English otherwise.

Can I run several shops in one account?

Yes. Each shop has its own Shop ID, script tag, buyer credentials and settings. How many shops an organisation can have depends on its plan. For shops that need their own team and their own plan, create a second organisation: it has its own shops, members and billing. See Team.

My shop sends a Content Security Policy. What do I add?

Four lines, which the Embed tab’s Content Security Policy section shows with the values for your shop:

script-src https://js.punchout.dev
connect-src https://api.punchout.dev
style-src 'unsafe-inline'
form-action https://<host of each buyer system>:*

The panel loads from js.punchout.dev (script-src), talks to api.punchout.dev (connect-src) and has inline styles (style-src 'unsafe-inline'). The cart is handed to the buyer system from the shop page, which needs form-action. The portal builds the form-action line from Allowed return hosts on the General tab, one https://<host>:* source per host (any port, because SAP systems often answer on ports other than 443). While that list is empty, it shows the placeholder https://buyer-system.example. For the test punchout, form-action must also allow https://api.punchout.dev. See Install the tag.

Are prices transferred gross or net?

Prices are handed over the way the buyer system expects them, and you choose gross or net in the portal. By default, they go over as the cart page shows them. If your cart shows prices including VAT and the buyer system expects net prices, set Price quality to “VAT included — strip it” and a VAT rate on the shop’s General tab; punchout.dev then hands over net prices, rounded to two decimals. Craftsman software receives net prices, and gross prices as well once a VAT rate is set.

Can buyers see their own prices?

Yes, with auto-login. The launch signs the buyer in to the customer account that belongs to their buyer credential, so the cart carries that customer’s prices. Auto-login needs a plugin or your own login endpoint and works with the hosted launches. Without it, the buyer shops as a guest. See Auto-login.

Can the buyer leave without transferring a cart?

Yes. Back to procurement system in the panel asks “Return to the procurement system without items?” and, after Yes, go back, hands the buyer system an empty return in its own protocol. The punchout ends there.

What does it cost, and what is the Sandbox?

The Sandbox is the free plan. Each shop gets a Sandbox period in which setup and test punchouts work without a card, within the daily budget. Launches from a real buyer system are refused until the organisation is on a paid plan. Each plan includes a number of connections; one connection is one enabled buyer credential, and on a paid plan owners can book more. The monthly transfer allowance is a soft limit: a transfer is never refused, and the owners get an email at 80 % and at 100 %. Prices and limits: pricing and Plans and Sandbox.

Where is my data hosted, and is it GDPR compliant?

punchout.dev is hosted on AWS in Frankfurt, and the data stays in the EU. For punchout sessions the shop is the controller and punchout.dev the processor. Retention periods: Security and privacy. Sub-processors and the data processing agreement: privacy policy.

Is there an API or an MCP server?

Not today. You manage shops, buyers and settings in the portal.