How punchout works

Somewhere in your inbox is a message from your biggest customer that says something like: “Our procurement team is asking whether you support punchout catalogs. Do you have a cXML endpoint?” If you run a B2B store on Shopify and that sentence reads like a different language, this guide is the long answer. It covers what punchout actually is, the full round trip step by step, the difference between cXML and OCI, what Shopify already gives you, what the buyer networks will ask of you, and where a connector fits.

What punchout is

Punchout is how large companies buy from suppliers without leaving their own purchasing software. Your buyer does not browse the open web. They work inside a procurement system: SAP Ariba, Coupa, Jaggaer, Oracle, Workday, or an SAP ERP. When they need your products, they click your name inside that system. Your catalog opens in a window, they shop, and the cart travels back into their system as a requisition. They never re-enter the cart or pay on your storefront. The purchase order arrives later, through a separate message.

All this ceremony exists for control. Procurement teams are paid to enforce approval chains, budgets and negotiated prices on every order. A public web store enforces none of that, so their software wraps yours: the shopping happens in your store, the ordering happens in theirs.

For a supplier, punchout is the difference between being a preferred supplier on paper and in practice. When ordering from you means leaving the system, copying part numbers into a form and attaching a PDF, buyers drift toward whoever is wired in. When your catalog is one click inside their tool, at contract prices, staying with you is the path of least resistance.

The round trip, step by step

A punchout relationship has two halves: the shopping trip out, and the purchase order back. Six steps cover the whole loop.

cXML versus OCI

Two protocols cover nearly all punchout traffic, and which one you need depends entirely on which systems your buyers run.

cXML (Commerce XML) is the standard of the Ariba world, and by adoption the bigger of the two. It is document-based: four XML document types make a complete cycle (PunchOutSetupRequest, PunchOutSetupResponse, PunchOutOrderMessage, OrderRequest). Coupa, Jaggaer, Oracle and Workday all speak it. Its defining strength is the return leg: purchase orders travel back over the same protocol, so both directions run as structured documents. If your buyers are large North American enterprises, cXML is almost certainly what they mean by punchout. See the Ariba and Coupa pages for the specifics of each network.

OCI (Open Catalog Interface) is SAP's older, deliberately simple standard, dominant in German-speaking Europe and common wherever SAP SRM or S/4HANA handles purchasing. There are no XML documents on the way out: the ERP calls your catalog URL with a HOOK_URL parameter, and the cart returns as indexed NEW_ITEM form fields. OCI moves carts, not purchase orders; the PO comes back on whatever channel the ERP supports, which ranges from a clean cXML OrderRequest to a printout. The practical complexity lives in field dialects: units, material groups and custom NEW_ITEM extensions vary by installation. Details on the OCI page.

Many European suppliers eventually need both: one buyer on Ariba, the next on a self-hosted SAP. That is the argument for handling the two protocols in one connector instead of two projects. For the differences that show up in real integrations, field dialects and the purchase-order return leg included, see cXML vs OCI, practically.

What Shopify gives you, and what it does not

Here is the good news. Shopify B2B already covers the commercial half of the punchout checklist, the half that is genuinely hard to retrofit: company accounts with multiple locations, catalogs and price lists per location (this is your contract pricing), quantity rules like minimums and case increments, payment terms, and checkout controls. If you sell wholesale on Shopify today, the pricing and entitlement model that punchout buyers require is probably already configured.

What Shopify does not have, on any plan, is a punchout endpoint. There is nothing to receive a PunchOutSetupRequest, no shared-secret validation, no PunchOutOrderMessage on cart transfer, no OCI HOOK_URL handling, no OrderRequest ingestion. Shopify's B2B feature set ends at your storefront's edge; punchout is precisely the machinery that reaches beyond that edge into the buyer's system.

That gap is what a connector fills: the protocol endpoints, the credential validation, the session that maps a network identity to the right company location, the cart transformation on the way out, the purchase order ingestion on the way back, and the logging that holds it all accountable.

What buyer networks require from suppliers

The protocol is the fast half of a punchout project. The slow half is enablement: the process each network or buyer runs before your connection goes live. It differs sharply by network, and it is worth knowing before you promise a go-live date.

Ariba is the heavyweight. You establish a trading relationship on SAP Business Network, exchange identities and a shared secret, upload a catalog index file per buyer for validation, and test in the buyer's test realm before publishing. Punchout realistically requires an Enterprise account, and Ariba is the one major network that charges suppliers: a 0.155% transaction fee capped at 20,000 USD per buyer relationship per year once thresholds are passed, and subscription tiers where cXML automation lands you in Silver at 750 USD per year. Real buyer documentation quotes 8 to 12 weeks of calendar time, most of it coordination rather than engineering.

Coupa is the lightweight. The Coupa Supplier Portal is free, there are no supplier fees, and your buyer's admin configures the punchout connection themselves inside their own instance. You provide a URL, identities, a secret and test credentials. First connections commonly land within a week or two, which makes a Coupa buyer the ideal first punchout project.

Jaggaer, Oracle and Workday sit in between: cXML based, no supplier fees, with enablement run by the buyer's project team at the buyer's pace. OCI buyers are different again: there is no central network at all, just the buyer's ERP team and their field mapping requirements.

Across all of them, one pattern repeats: the engineering hours are small and the coordination weeks are not. The lever you control is how fast each test loop closes. Raw session logs your buyer's IT team can read without a call are the single best tool for that.

How PunchRelay fits in

For the practical next steps, follow our Shopify PunchOut setup guide, including the merchant-side self-test and buyer acceptance checks. Review PunchRelay pricing when planning your first buyer connection.

cXML purchase orders are accepted durably, checked against the transferred cart and placed in the Purchase orders inbox in the PunchRelay app. Nothing is created in Shopify until someone on your team reviews the PO and clicks Create Shopify order. The order is then created unpaid, with payment pending, ready to fulfill. OCI returns a cart only; the purchase-order leg is agreed and tested separately for each buyer.

We are onboarding early access merchants now and building their first buyer connections with them. If a customer just asked you for punchout, start with the page that matches their system: SAP Ariba, Coupa, or OCI for SAP. Or leave your email below and we will map the shortest path to your first live connection.