Lynx Punchout

Description

Large customers often buy through a procurement system (SAP SRM, SAP Ariba, Coupa and others). They expect suppliers to offer a punchout catalogue: the buyer opens your shop from their procurement system, fills a cart, and the cart goes back to the procurement system instead of going through your checkout.

Try it as a buyer, without any procurement system: live demo.

Lynx Punchout adds this to a WooCommerce shop:

  • SAP OCI and cXML punchout, from the same shop.
  • The buyer is logged in automatically with the customer account you choose, so they see their own prices and catalogue.
  • On the cart page, the checkout button is replaced by “Transfer to your procurement system” for punchout sessions only. Your regular customers are not affected.
  • cXML edit and inspect operations are supported (the previous cart is reloaded; inspect is read-only).
  • Buyers are managed from your WordPress admin: login, password, allowed return domains, linked customer account.
  • Purchase orders (Pro plan): cXML purchase orders (OrderRequest) sent by the procurement system become WooCommerce orders, at the prices of the purchase order. Setting the order to “Processing” sends the order confirmation, “Cancelled” rejects it, “Completed” sends the ship notice (with the tracking number of WooCommerce Shipment Tracking, if used).
  • Compatible with WooCommerce High-Performance Order Storage.

This plugin needs the Lynx Punchout service

The plugin is the WordPress side of a hosted service. The Lynx Punchout gateway receives the punchout requests of the procurement systems, checks the buyer’s credentials, and converts the cart to the OCI or cXML format expected by each system. The plugin cannot do punchout without it.

The service is paid, per shop, after a 14-day free trial that needs no payment details and includes everything:

  • Standard: 9 EUR per month or 90 EUR per year (punchout).
  • Pro: 19 EUR per month or 190 EUR per year (punchout and cXML purchase orders).

All the code of the plugin is included and nothing in it is locked; the gateway decides what the subscription covers. Without an active subscription the service stops accepting punchout sessions, cart transfers and purchase orders.

External services

This plugin connects to the Lynx Punchout gateway (https://api.lynx-market.cloud), operated by Lynx Market. Nothing is sent before you click “Activate” on the plugin’s settings page.

What is sent, and when:

  • When you click “Activate”: your site address, your site name and a single-use verification code. The gateway then calls your site back once to deliver the shop ID and licence key.
  • When you manage buyers: the buyer’s login, password, allowed return domains, the login of the linked WordPress account and, optionally, the address where order documents are sent. The gateway stores the password hashed, plus an encrypted copy needed to authenticate the order documents it sends to the procurement system.
  • When a buyer opens a punchout session: the single-use token received in the link, to obtain the session details.
  • When a buyer transfers a cart: the cart lines (product ID, SKU, name, quantity, price excluding tax, currency) and the site language. No customer address or payment data is sent.
  • When you click “Test connection”: a signed empty request.
  • Purchase orders: the procurement system sends its purchase orders to the gateway, which keeps them for 180 days (order number, lines, delivery and billing addresses, buyer comments). The gateway then calls your site’s route lynx-punchout/v1/orders/sync without any data, and the plugin fetches the pending orders with a signed request, then sends back the ID of the WooCommerce order created. This also runs once an hour.
  • When a purchase order changes status (Processing, Cancelled, Completed): its gateway ID, the kind of document to send, and for a shipment the carrier and tracking number. The gateway forwards the document to the procurement system.

Requests are signed with your licence key and sent over HTTPS.

The subscription is paid with PayPal on PayPal’s own pages; the plugin only links to them.

  • Service terms: https://lynx-market.cloud/conditions/
  • Privacy policy: https://lynx-market.cloud/confidentialite/
  • PayPal privacy statement: https://www.paypal.com/webapps/mpp/ua/privacy-full

Screenshots

Installation

  1. Install and activate the plugin. WooCommerce must be active.
  2. Go to WooCommerce > Lynx Punchout and click “Activate”. This creates your shop on the gateway and starts the free trial.
  3. Go to WooCommerce > Punchout buyers and add a buyer: the login and password your customer will enter in their procurement system, the domain of that system, and the WordPress customer account the buyer will shop with.
  4. Give your customer the OCI or cXML address shown at the top of the buyers page, with the login and password.
  5. Ask your customer to open the catalogue from their procurement system and transfer a test cart.

FAQ

Does it change the shop for my regular customers?

No. The transfer button and the checkout redirection apply only during a punchout session.

Which accounts can a buyer be linked to?

Customer accounts only. Administrators, shop managers and other staff accounts are refused, so a punchout link can never open a privileged session.

Why must the REST API be reachable for activation?

The gateway delivers your licence key to your site itself, to prove that the site address is yours. If a security plugin blocks the REST API for visitors, allow the route lynx-punchout/v1/activate or enter the shop ID and licence key by hand.

What happens when the subscription ends?

Punchout sessions and cart transfers stop. Your shop keeps working normally for everyone else. Uninstalling the plugin removes its settings and user flags.

How do I receive purchase orders from SAP Ariba?

In your Ariba supplier account, choose cXML for electronic order routing, with the cXML address shown at the top of the Punchout buyers page and a shared secret. Create one buyer per customer: its login is the customer’s Ariba Network ID (the From identity of their documents), its password is that shared secret. To send order confirmations and ship notices back, enter the order documents address given in your Ariba account on the buyer. Changed and cancelled purchase orders are not handled yet: they are refused, and appear as failed in Ariba.

My procurement system needs a specific field or unit.

Contact us: field mappings are handled on the gateway, without changing the plugin.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Lynx Punchout” is open source software. The following people have contributed to this plugin.

Contributors

Translate “Lynx Punchout” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

0.4.0

  • Purchase orders (Pro plan): cXML purchase orders become WooCommerce orders; order confirmation, rejection and ship notice are sent back to the procurement system when the order status changes.
  • French translation: punctuation restored after typographic spaces.

0.3.7

  • Cart transfer works when the procurement system shows the shop in a frame (the transfer page no longer sends the anti-framing headers of the WordPress admin).

0.3.6

  • Default UNSPSC code for cXML carts (setting), used when a product and its categories have none.
  • Works when the procurement system shows the shop in a frame: during a punchout session on HTTPS, login and cart cookies are sent with SameSite=None and Partitioned.
  • French translation: typographic spaces.

0.3.5

  • Hardening: only administrators can change the gateway address.

0.3.4

  • Declares the WooCommerce dependency (Requires Plugins).
  • Shop managers can save the settings.
  • Hardening: activation endpoint checks the challenge in its permission callback; return form escaped at output, no inline event handlers; unknown charsets fall back to UTF-8.

0.3.3

  • Works with the block-based Cart (default in recent WooCommerce): during a punchout session the cart shows the transfer button.
  • Activation message no longer announces a free trial when none is available.

0.3.2

  • During a punchout session, orders can no longer be placed through the WooCommerce Store API or the classic checkout endpoint; the read-only cart (cXML inspect) is also enforced there.

0.3.1

  • Prices shown without tax wording.

0.3.0

  • Self-service activation and buyer management from the WordPress admin.

0.2.1

  • Yearly subscription.

0.2.0

  • PayPal subscription links.

0.1.0

  • First version: OCI and cXML punchout, cart transfer.