How to Set Up cXML PunchOut on PrestaShop 9

What Is cXML PunchOut?

cXML (Commerce eXtensible Markup Language) PunchOut is a protocol that lets enterprise buyers launch a shopping session from inside their procurement system, browse your catalog, add items to a cart, and return a structured order message — all without leaving their ERP workflow.

The buyer never creates an account on your store. Instead, their procurement system authenticates via a SharedSecret HMAC handshake, and your store serves a buyer-specific catalog session. When the buyer checks out, a cXML PunchOutOrderMessage is sent back to their system — ready for approval and PO creation.

Why PrestaShop 9 Needs a Dedicated Module

PrestaShop 9 does not include cXML PunchOut support out of the box. The protocol requires:

• A dedicated endpoint to receive PunchOutSetupRequest XML
• Session management tied to the buyer's BuyerCookie
• A modified cart flow that returns PunchOutOrderMessage instead of creating an order
• Per-buyer SharedSecret validation (HMAC-SHA256)
• Separate routing for OCI platforms like SAP Ariba

Building this from scratch typically takes 200–400 hours of development. PunchOutHub implements all of this as a native PrestaShop 9 module — installed in minutes, configured from the admin panel.

Step-by-Step Setup with PunchOutHub

Step 1 — Install the Module

Upload the .zip file via PrestaShop Admin → Module Manager → Upload. The module installs and creates its database tables automatically. A file integrity manifest is sealed on first enable, protecting against tampering.

Step 2 — Activate Your License

Open Admin → PunchOut → Dashboard. Paste your license key (format: PO-STD.[payload].[signature]) and click Activate. The license is permanently bound to your domain — verified via RSA-SHA256 public key signature on every request.

Step 3 — Add Your First Buyer

Go to Admin → PunchOut → Buyers → Add New Buyer. Enter:

• Buyer Domain (e.g., networkid:AN01234567890)
• Platform (Oracle Fusion / SAP Ariba / Coupa / Jaggaer)
• SharedSecret (provided by the buyer's procurement team)
• Customer Group (maps to your PrestaShop pricing group for this buyer)

Step 4 — Share the Endpoint URL

PunchOutHub generates the endpoint URL automatically:

https://yourstore.com/module/punchouthub/punchout

For SAP Ariba (OCI), the catalog URL is separate:

https://yourstore.com/module/punchouthub/catalog

Send these to your buyer's procurement admin. For Oracle Fusion, they configure this in iProcurement → Procurement → Manage Stores. For SAP Ariba, it goes into the Ariba Network supplier profile.

Step 5 — Test with Postman

Before connecting your buyer's live system, test the full flow using Postman. Send a sample PunchOutSetupRequest to your endpoint and verify you receive a valid PunchOutSetupResponse with a session URL. PunchOutHub's diagnostic dashboard shows each request in real time — session open, items browsed, cart returned.

Step 6 — Go Live

Once Postman returns a 200 OK with a valid session URL, share the credentials with your buyer's IT team for production deployment. Most buyers are ready to test from their procurement system within a single business day.

Supported Platforms

Production Reference

A Thailand-based enterprise supplier runs PunchOutHub on PrestaShop 9 with over 1,000 active SKUs connected to Oracle Fusion iProcurement. Setup took quickly. The flow reduces manual order re-entry and improves procurement traceability.

Common Setup Issues