Somewhere in your inbox is a message from your biggest customer that says something like: “Our procurement team is asking whether you support punchout catalogs. Do you have a cXML endpoint?” If you run a B2B store on Shopify and that sentence reads like a different language, this guide is the long answer. It covers what punchout actually is, the full round trip step by step, the difference between cXML and OCI, what Shopify already gives you, what the buyer networks will ask of you, and where a connector fits.
What punchout is
Punchout is how large companies buy from suppliers without leaving their own purchasing software. Your buyer does not browse the open web. They work inside a procurement system: SAP Ariba, Coupa, Jaggaer, Oracle, Workday, or an SAP ERP. When they need your products, they click your name inside that system. Your catalog opens in a window, they shop, and the cart travels back into their system as a requisition. They never press a checkout button on your site, and no money moves through it. The purchase order arrives later, through a separate message.
All this ceremony exists for control. Procurement teams are paid to enforce approval chains, budgets and negotiated prices on every order. A public web store enforces none of that, so their software wraps yours: the shopping happens in your store, the ordering happens in theirs.
For a supplier, punchout is the difference between being a preferred supplier on paper and in practice. When ordering from you means leaving the system, copying part numbers into a form and attaching a PDF, buyers drift toward whoever is wired in. When your catalog is one click inside their tool, at contract prices, staying with you is the path of least resistance.
The round trip, step by step
A punchout relationship has two halves: the shopping trip out, and the purchase order back. Six steps cover the whole loop.
- Setup request. The buyer clicks your catalog. Their system calls your punchout endpoint with an authenticated request. In cXML this is a PunchOutSetupRequest document carrying network identities and a shared secret. In OCI it is an HTTP call carrying USERNAME, PASSWORD and a HOOK_URL return address.
- Session start. Your side validates the credentials, works out which company and which contract prices this buyer gets, and answers with a start URL. The buyer's browser opens your catalog, already signed in to the right account.
- Shopping. The buyer browses your actual store: your product data, your images, your stock levels. The prices they see are their negotiated prices, not the public list.
- Cart transfer. Instead of a checkout there is a transfer action. The cart leaves as a structured message, a PunchOutOrderMessage in cXML or a set of NEW_ITEM form fields in OCI, and lands in the buyer's system as a draft requisition.
- Approval. The requisition works through the buyer's approval chain. This can take an hour or three weeks. Your store is not involved and nothing on your side waits.
- Purchase order. The approved requisition becomes a purchase order. On cXML networks the PO can be transmitted straight back to your endpoint as an OrderRequest document and become an order in your store, untouched by human hands.
The two halves matter because plenty of integrations only do the first one. The cart reaches the buyer beautifully, and then the purchase order comes back as a PDF that someone on your team retypes on a Friday afternoon. When you evaluate any punchout setup, ask about both directions.
cXML versus OCI
Two protocols cover nearly all punchout traffic, and which one you need depends entirely on which systems your buyers run.
cXML (Commerce XML) is the standard of the Ariba world, and by adoption the bigger of the two. It is document-based: four XML document types make a complete cycle (PunchOutSetupRequest, PunchOutSetupResponse, PunchOutOrderMessage, OrderRequest). Coupa, Jaggaer, Oracle and Workday all speak it. Its defining strength is the return leg: purchase orders travel back over the same protocol, so full automation in both directions is the normal case. If your buyers are large North American enterprises, cXML is almost certainly what they mean by punchout. See the Ariba and Coupa pages for the specifics of each network.
OCI (Open Catalog Interface) is SAP's older, deliberately simple standard, dominant in German-speaking Europe and common wherever SAP SRM or S/4HANA handles purchasing. There are no XML documents on the way out: the ERP calls your catalog URL with a HOOK_URL parameter, and the cart returns as indexed NEW_ITEM form fields. OCI moves carts, not purchase orders; the PO comes back on whatever channel the ERP supports, which ranges from a clean cXML OrderRequest to a printout. The practical complexity lives in field dialects: units, material groups and custom NEW_ITEM extensions vary by installation. Details on the OCI page.
Many European suppliers eventually need both: one buyer on Ariba, the next on a self-hosted SAP. That is the argument for handling the two protocols in one connector instead of two projects. For the differences that show up in real integrations, field dialects and the purchase-order return leg included, see cXML vs OCI, practically.
What Shopify gives you, and what it does not
Here is the good news. Shopify B2B already covers the commercial half of the punchout checklist, the half that is genuinely hard to retrofit: company accounts with multiple locations, catalogs and price lists per location (this is your contract pricing), quantity rules like minimums and case increments, payment terms, and checkout controls. If you sell wholesale on Shopify today, the pricing and entitlement model that punchout buyers require is probably already configured.
What Shopify does not have, on any plan, is a punchout endpoint. There is nothing to receive a PunchOutSetupRequest, no shared-secret validation, no PunchOutOrderMessage on cart transfer, no OCI HOOK_URL handling, no OrderRequest ingestion. Shopify's B2B feature set ends at your storefront's edge; punchout is precisely the machinery that reaches beyond that edge into the buyer's system.
That gap is what a connector fills: the protocol endpoints, the credential validation, the session that maps a network identity to the right company location, the cart transformation on the way out, the purchase order ingestion on the way back, and the logging that holds it all accountable.
What buyer networks require from suppliers
The protocol is the fast half of a punchout project. The slow half is enablement: the process each network or buyer runs before your connection goes live. It differs sharply by network, and it is worth knowing before you promise a go-live date.
Ariba is the heavyweight. You establish a trading relationship on SAP Business Network, exchange identities and a shared secret, upload a catalog index file per buyer for validation, and test in the buyer's test realm before publishing. Punchout realistically requires an Enterprise account, and Ariba is the one major network that charges suppliers: a 0.155% transaction fee capped at 20,000 USD per buyer relationship per year once thresholds are passed, and subscription tiers where cXML automation lands you in Silver at 750 USD per year. Real buyer documentation quotes 8 to 12 weeks of calendar time, most of it coordination rather than engineering.
Coupa is the lightweight. The Coupa Supplier Portal is free, there are no supplier fees, and your buyer's admin configures the punchout connection themselves inside their own instance. You provide a URL, identities, a secret and test credentials. First connections commonly land within a week or two, which makes a Coupa buyer the ideal first punchout project.
Jaggaer, Oracle and Workday sit in between: cXML based, no supplier fees, with enablement run by the buyer's project team at the buyer's pace. OCI buyers are different again: there is no central network at all, just the buyer's ERP team and their field mapping requirements.
Across all of them, one pattern repeats: the engineering hours are small and the coordination weeks are not. The lever you control is how fast each test loop closes. Raw session logs your buyer's IT team can read without a call are the single best tool for that.
How PunchRelay fits in
PunchRelay is a punchout connector built only for Shopify. It gives your store cXML and OCI endpoints, validates each buyer's credentials, opens punchout sessions against the Shopify B2B company location you assign, enforces your quantity rules before the cart transfers, returns the cart in the dialect the buyer's system expects, and turns incoming cXML OrderRequests into Shopify orders with an acknowledgment in under 150 milliseconds. Every message in both directions is logged raw, because the log is what shortens enablement.
We are onboarding early access merchants now and building their first buyer connections with them. If a customer just asked you for punchout, start with the page that matches their system: SAP Ariba, Coupa, or OCI for SAP. Or leave your email below and we will map the shortest path to your first live connection.