Epicor Kinetic and PayPal integration

What moves between them

The primary flow is PayPal into Epicor Kinetic. PayPal payment events and refunds arrive via webhook, and ml-connector matches each transaction to a customer or vendor record in Epicor Kinetic by email or a mapped reference field. Revenue journals are posted to the Epicor Kinetic GL account specified in the flow mapping, and the customer AR balance is updated. Vendor payouts flowing the other direction are read from Epicor Kinetic's AP module on a poll schedule and referenced in PayPal payout requests by email address. GL postings are complete in both directions within minutes of the PayPal event or the Epicor Kinetic data extraction.

How ml-connector handles it

ml-connector stores Epicor Kinetic OAuth2 or API Key credentials encrypted in the cell database and refreshes tokens before they expire. PayPal OAuth2 credentials are cached for the 8-hour token lifetime and refreshed on demand. Every incoming PayPal webhook is verified against the RSA-SHA256 signature in the paypal-transmission-sig header before any record is created or updated. On the Epicor Kinetic side, ml-connector queries customers and GL accounts using OData filters on the UpdatedOn field to fetch only changed records since the last sync, and it honors the mandatory Company segment in the URL path for multi-tenant deployments. Because Epicor Kinetic is poll-only and PayPal supports webhooks, the integration polls Epicor Kinetic on a schedule (every hour for AR, every 6 hours for AP) and listens to PayPal webhooks in real time. The two-step write pattern in Epicor Kinetic is handled automatically: fetch GetNewAPPayment or GetNewAPInvoiceHeader, populate the fields, then UpdateMaster. Bearer tokens are refreshed before expiry, and any PayPal HTTP 429 rate-limit response triggers an exponential backoff retry.

A real-world example

A mid-market distribution company runs Epicor Kinetic for inventory, order management, and finance, and accepts customer payments through PayPal. Before integration, the finance team exported PayPal transaction reports twice daily and manually matched each payment to a customer invoice in Epicor Kinetic, then keyed the revenue journal by hand. Month-end reconciliation involved cross-checking transaction IDs and hunting for mismatches. With PayPal and Epicor Kinetic connected, each customer payment posts automatically to the correct GL revenue account and customer AR line as soon as PayPal confirms receipt. Refunds reverse the journal entry automatically. Month-end close is complete as soon as PayPal's settlement batch for the prior day finishes processing, and AR reconciliation is a single query against the audit trail.

What you can do

• •Post PayPal transaction and refund events into Epicor Kinetic's general ledger on the matching GL revenue account and customer AR line.
• •Match PayPal transactions to Epicor Kinetic customers by email address or a custom reference field to ensure revenue lands on the correct account.
• •Verify PayPal webhook signatures with RSA-SHA256 and store OAuth2 credentials encrypted so sensitive data never appears in logs.
• •Retrieve vendor records from Epicor Kinetic and trigger PayPal payouts by email address on a schedule you control, with retries and a full audit trail.
• •Respect Epicor Kinetic's two-step write pattern and Company segment requirements, and handle Bearer token refresh and rate-limit backoff automatically.

Questions

How does the integration handle the difference between Epicor Kinetic's polling model and PayPal's webhook push model?

ml-connector polls Epicor Kinetic on a regular schedule (every hour for customer changes, every 6 hours for AP data) and listens to PayPal webhooks in real time. When a PayPal payment arrives by webhook, it is matched to the corresponding customer in Epicor Kinetic and the GL journal is posted immediately. Vendor payouts are triggered by polling Epicor Kinetic for pending AP payments and requesting PayPal to send the payout to a pre-configured email address.

What authentication does ml-connector use for Epicor Kinetic and PayPal?

For Epicor Kinetic, ml-connector supports OAuth2 client credentials for cloud SaaS, or API Key and Basic Auth for on-premises and cloud deployments. OAuth2 tokens are refreshed before expiry. For PayPal, ml-connector uses OAuth2 client credentials and caches the Bearer token for up to 8 hours, refreshing on demand. Both credential sets are stored encrypted in the cell database.

How does ml-connector match PayPal transactions to Epicor Kinetic customers if there is no shared customer ID?

ml-connector can match by email address if the PayPal customer email is also recorded in Epicor Kinetic's customer email field, or by a custom reference field (such as an invoice or PO number) that is passed in both the PayPal payment metadata and the Epicor Kinetic customer record. The mapping is configurable per flow so you control which field or combination is authoritative for the match.