cXML PunchOut sits at the boundary between two systems' authentication and audit boundaries. The plugin defends against the threats that come up most often in real B2B procurement integrations.
Trading partners authenticate by including a <SharedSecret> element in the cXML <Sender> block. The plugin
verifies this on every inbound request:
Sign in with your Vendure Console account to read this documentation.