Epicor Kinetic and BigCommerce integration

What moves between them

Two directions. Outbound, ml-connector reads Epicor Kinetic parts and posts or updates the matching BigCommerce catalog products, syncs unit prices, and writes inventory levels onto the product variants so the store reflects ERP stock. Inbound, each new or updated BigCommerce order becomes an Epicor Kinetic sales order, and the buyer becomes or matches an Epicor customer record. Inbound order work is triggered by BigCommerce order webhooks and a scheduled poll catches anything a webhook missed. The Epicor side is read and written by polling, since Kinetic has no push events. GL accounts and vendors stay in Epicor, since BigCommerce has none.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Epicor side it presents the x-api-key header on every call in addition to Basic or IdP OAuth2 identity, accepts the full tenant URL with instance and Company per customer, and refreshes the bearer token before it expires at roughly one hour. On the BigCommerce side it sends the static X-Auth-Token and verifies the HMAC-SHA256 X-BC-Signature on every inbound webhook with a constant-time compare, rejecting anything that fails. Because a webhook payload is only a type and id, the handler immediately calls GET on the v2 order to load the full record before mapping it. SKU maps to PartNum so catalog and order lines land on the right Epicor parts. Sales order writes use the Kinetic GetNew then UpdateMaster pattern. Epicor publishes no rate-limit headers, so outbound polling is paced conservatively, while BigCommerce 429 responses are honored by reading X-Rate-Limit-Time-Reset-Ms and waiting. Since BigCommerce webhooks auto-deactivate after about 48 hours of failures or 90 days of inactivity, a periodic check confirms each hook is active and re-registers it if not.

A real-world example

A mid-sized industrial parts distributor with about 150 staff runs Epicor Kinetic for inventory, purchasing, and finance, and sells a few thousand SKUs through a BigCommerce storefront. Before the integration, a clerk exported new web orders into a spreadsheet each morning and keyed them into Epicor as sales orders, while stock counts on the store drifted from the ERP and oversold items had to be canceled by hand. With Epicor Kinetic and BigCommerce connected, parts and live inventory levels publish to the catalog automatically, and each web order lands in Epicor as a sales order within minutes of checkout. The morning re-keying is gone and the store stops selling stock the warehouse does not have.

What you can do

• •Publish Epicor Kinetic parts and price changes into the BigCommerce catalog so the store matches the ERP.
• •Write Epicor inventory levels onto BigCommerce product variants to reduce overselling.
• •Turn each new BigCommerce order into an Epicor Kinetic sales order, creating or matching the customer record.
• •Verify every BigCommerce X-BC-Signature webhook, then fetch the full order from the REST API before posting it.
• •Bridge the Epicor x-api-key and tenant login to the BigCommerce static token, with retries and a full audit trail on every record.

Questions

Which direction does data move between Epicor Kinetic and BigCommerce?

Both directions. Parts, prices, and inventory move from Epicor Kinetic out to the BigCommerce catalog, and new orders plus their customers move from BigCommerce back into Epicor as sales orders. GL accounts and vendors stay in Epicor, since BigCommerce has no accounting objects to sync.

How does the integration know about new BigCommerce orders without polling Epicor?

BigCommerce pushes a signed webhook when an order is created or updated, and ml-connector verifies the HMAC-SHA256 X-BC-Signature before acting. Because the webhook payload carries only the order type and id, the handler then calls the BigCommerce REST API to load the full order before creating the Epicor sales order. A scheduled poll backfills anything a webhook missed, and the Epicor side is polled because Kinetic has no outbound webhooks.

How are Epicor authentication and BigCommerce authentication handled together?

ml-connector stores both credential sets encrypted and presents each system its own auth. Epicor Kinetic requires Basic or Epicor IdP OAuth2 identity plus a separate x-api-key header on every v2 call, and bearer tokens are refreshed before they expire. BigCommerce uses a single static X-Auth-Token tied to the store_hash, which is sent on every request.