Punchout API
The Punchout API enables seamless login integration between external procurement systems and VTEX. It allows procurement system users to authenticate into VTEX without manual credential management, using a secure OAuth2-like flow with real-time credential validation and one-time tokens (OTT).
Learn more about Punchout login integration.
Endpoint requirements
- OTTs expire after 5 minutes and are single-use to prevent replay attacks.
- Return URLs are validated against authorized hosts to prevent open redirect vulnerabilities.
Endpoints
Punchout login
| Summary | Method | Path |
|---|---|---|
| Start VTEX user punchout flow | POST | /api/authenticator/punchout/start |
| Start pre-authenticated user punchout flow | POST | /api/authenticator/punchout/authenticated/start |
| Finish punchout login flow | GET | /api/authenticator/punchout/finish |