Shopware 6

The punchout.dev plugin for Shopware 6.7 prints the script tag, marks the cart page for punchout.dev and signs punchout buyers in to their customer account.

Requirements

Requirement	Value
Shopware	6.7 (>=6.7 <6.8)
PHP extensions	sodium, json
Plugin	PunchoutDev, version 2.0.1 or newer
Download	PunchoutDev-<version>.zip from the shop’s Embed tab in the portal (Shop platform: Shopware)

Install

In the Administration

1. Download the plugin from the portal’s Embed tab.
2. In the Shopware Administration, upload the zip in the extension management under Extensions.
3. Install and activate punchout.dev.

On the command line

Unpack the zip into custom/plugins. It contains one folder, so the plugin lands in custom/plugins/PunchoutDev. Then run:

bin/console plugin:refresh
bin/console plugin:install --activate PunchoutDev
bin/console cache:clear

plugin:install runs the plugin’s migration, which creates the table the plugin needs to accept each login token only once. Without that table every auto-login fails and the buyer continues as a guest.

Configure

In the Administration, open Extensions and choose Configure on the punchout.dev entry. You can set every value per sales channel.

Snippet card

Setting	Value
Embed the snippet	On (default). Off prints no script tag at all.
Snippet URL	https://js.punchout.dev/pob.js, from the portal’s Embed tab. Empty prints nothing.
API base URL (optional)	Leave empty.

Auto-login card

Setting	Value
Enable auto-login	On (default).
Shop ID	The Shop ID from the portal’s Embed tab.
Public key lines	Every line from the portal’s Auto-login tab, section Public keys, one per line. Lines starting with # and blank lines are ignored.

Caution

The Shop ID sits in the Auto-login card, but the script tag needs it too: the plugin prints it as data-shop-id. Fill it in even if you do not use auto-login. Without it, the plugin prints no script tag.

The same values from the command line:

bin/console system:config:set PunchoutDev.config.snippetUrl https://js.punchout.dev/pob.js
bin/console system:config:set PunchoutDev.config.tenantId pob_live_…
bin/console system:config:set PunchoutDev.config.publicKeys "k1=…"
bin/console cache:clear

The plugin prints this tag on every storefront page, in the block base_body_script:

<script async src="https://js.punchout.dev/pob.js" data-shop-id="pob_live_…"></script>

What the plugin marks

On the cart page the plugin wraps the Twig block page_checkout_cart_product_table in <div data-punchout-cart>. That block renders the line-item table and nothing else: the order summary, the promotion form and the checkout button stay outside. The plugin prints the marker even when Embed the snippet is off. On its own, the marker does nothing.

Auto-login

The plugin’s login endpoint is GET /punchout-dev/login?token=…. Set up the portal side on the shop’s Auto-login tab:

Portal field	Value
Adapter	Shopware
Login path	/punchout-dev/login for a shop at the domain root. A shop in a sub-folder prefixes its path, for example /shop/public/punchout-dev/login.
Customer reference	Customer ID, Customer number or Email address. All three work on Shopware.

Then give each buyer credential its Shop customer reference on the Buyers tab: the customer’s ID, customer number or email address, as chosen above.

After the login, the plugin redirects to the landing path as it is, without adding the shop’s base path. For a shop in a sub-folder, the Landing path on the General tab must include the sub-folder, for example /shop/public/checkout/cart.

The plugin signs a customer in only when exactly one active customer matches. Guest accounts never match, and a customer bound to another sales channel does not match either. The customer ID works with or without dashes. The full flow is on the Auto-login page.

Setup self-test

1. On the shop’s Setup tab in the portal, create a setup link (valid 60 minutes by default).
2. Put 2 or 3 different products in the cart.
3. Open the cart page with the setup link.

With the plugin in place, the panel shows “Shop plugin detected — the cart is already marked.” before you click. Click Detect cart, and the result names the source Shop plugin. Confirm with Yes, that’s it. The test proves that the marker is on the page and that the tag runs with the right Shop ID, and it completes the Cart detected step in the portal. Nothing else is stored for the cart, because punchout.dev reads the marker on every punchout.

Update

Download the new zip from the Embed tab, unpack it over custom/plugins/PunchoutDev, then:

bin/console plugin:refresh
bin/console plugin:update PunchoutDev
bin/console cache:clear

Coming from PunchoutNinja 1.x

Version 2.0.0 is a new plugin to Shopware: uninstall PunchoutNinja and delete its folder before installing PunchoutDev, and never run both. Nothing is carried over: enter both cards again and change the Login path on the portal’s Auto-login tab to /punchout-dev/login.

Troubleshooting

Symptom	Cause	Fix
No pob.js tag in the page source	Embed the snippet off, or Snippet URL or Shop ID empty for this sales channel	Switch Embed the snippet on and fill in both values, then bin/console cache:clear
The setup panel reports Preset or Detected automatically instead of Shop plugin	The marker did not reach the page: the theme overrides page_checkout_cart_product_table without calling parent(), or the storefront cache is stale	Call parent() in the theme’s block, then bin/console cache:clear
Every login is rejected with reason replay	The plugin’s table for used login tokens is missing	bin/console plugin:update PunchoutDev
Every login is rejected with reason expired	The shop’s clock runs fast	Synchronize the server clock
The buyer lands on a 404 page	The portal’s Login path does not match the route, often after the move from 1.x	Set it to /punchout-dev/login, with the sub-folder prefix if any
Auto-login does nothing and the buyer shops as a guest	Auto-login is on in the portal, but Enable auto-login is off or Shop ID / Public key lines are empty in the plugin (reason disabled or not_configured). The plugin redirects to the landing page without a login.	Fill in the Auto-login card, or turn auto-login off on the portal’s Auto-login tab

Note

When auto-login was switched off or unconfigured on the plugin side, plugin 2.0.0 redirected to / instead of the landing page, and the punchout was lost. Update to 2.0.1 or newer.

The plugin writes one warning per refused login token to the Shopware log, with a reason word. It never logs the token or the customer. The reason words are listed on the Auto-login page.

For more, see Troubleshooting.

Full README

The plugin’s README covers the token checks, the security notes and the development self-test: Shopware plugin README.