How does ml-connector handle BigCommerce webhook signature validation?

ml-connector stores the BigCommerce store client_secret encrypted and validates every incoming webhook using HMAC-SHA256 over the raw request body. The signature is compared in constant time to the X-BC-Signature header. If the signature is invalid, the webhook is rejected with 401 Unauthorized. Valid webhooks are then used to trigger a REST API call to fetch the full order detail, because BigCommerce webhook payloads contain only a type and ID.

What happens if a BigCommerce webhook auto-deactivates?

BigCommerce webhooks auto-deactivate after 90 days of inactivity or 48 hours of delivery failures. ml-connector logs the deactivation event in the audit trail and sends an alert so the integration operator can re-register the webhook. Re-registration is a one-time action in the control plane.

Does Plex role-based access control affect the integration?

Yes. The Plex integration account must have the correct role assigned to write sales orders and read inventory. If a write fails with 403 Forbidden, it indicates the integration account lacks the required role. The Plex administrator must grant the integration account the correct roles in the Plex identity provider.

PlexBigCommerce

Plex and BigCommerce integration

Plex runs your manufacturing and supply chain. BigCommerce runs your online store. Connecting them keeps orders flowing from your e-commerce front end into your production system without re-entry. New orders placed in BigCommerce create corresponding records in Plex so your production team can see what to build, and inventory levels updated in Plex can sync back to BigCommerce so your store reflects what you actually have in stock. ml-connector handles the very different APIs and authentication models on each side and moves the data on a schedule you control.

How Plex works

Plex exposes purchase orders, sales orders, customers, parts, inventory, GL accounts, and suppliers through Plex Connect, a cloud-native REST JSON API authenticated via OAuth 2.0 client credentials with tokens obtained from https://accounts.plex.com/oauth2/token. Plex also offers legacy SOAP XML Web Services with Basic auth. The REST API is available at https://cloud.plex.com/api and https://test.cloud.plex.com/api. Plex does not offer native webhooks, so connectors must poll on a configurable interval, filtering by modified_date or created_date. Role-based permissions are enforced per Plex user, so the integration account must have the correct roles to access the required entities. Rate limits are not publicly documented; exponential backoff is recommended on HTTP 429 responses.

How BigCommerce works

BigCommerce exposes orders, order transactions, refunds, customers, products, variants, and shipping addresses through a REST v3 API with a store-level static API key passed in the X-Auth-Token header. The base URL is https://api.bigcommerce.com/stores/{store_hash}/v3/, and store_hash is the alphanumeric segment from the API URL, not the store ID shown in the control panel. BigCommerce publishes events via webhooks, including store/order/created, store/order/updated, store/order/statusUpdated, and store/product/inventory/updated. Webhooks are delivered as HTTP POST requests with a HMAC-SHA256 signature in the X-BC-Signature header and a stub payload; the integration must call the REST API immediately to fetch the full record. Webhooks auto-deactivate after 90 days of inactivity or 48 hours of delivery failures. The rate limit is 450 requests per 30 seconds on Pro plans, 150 on Plus/Standard, and negotiated on Enterprise.

What moves between them

New and updated orders flow from BigCommerce to Plex. ml-connector listens for BigCommerce webhook events (store/order/created and store/order/updated), fetches the full order details via REST, maps customer names and line items, and writes the order into Plex as a sales order. Inventory levels can flow from Plex back to BigCommerce to keep product stock in sync with what Plex says is on hand. Order creation in BigCommerce typically arrives in Plex within one to five minutes via webhook delivery.

How ml-connector handles it

ml-connector stores the BigCommerce API key and Plex OAuth client credentials encrypted, refreshing the Plex token when a call returns 401 Unauthorized. On the BigCommerce side it registers for store/order/created and store/order/updated webhooks and validates each incoming webhook with the store's client_secret and HMAC-SHA256 verification, then immediately calls the REST API to fetch the full order detail because BigCommerce webhook payloads are stubs only. BigCommerce webhooks can auto-deactivate after 90 days of inactivity or 48 hours of failures, so ml-connector logs webhook status and alerts if a webhook is deactivated. BigCommerce rate limits refresh every 30 seconds; ml-connector backs off on 429 responses and retries with exponential jitter. On the Plex side, the integration account must have the correct role-based permissions to write sales orders; if a write fails with 403 Forbidden, it indicates a permissions issue rather than a data problem. Inventory syncs from Plex back to BigCommerce are also polled at a configurable interval because Plex does not offer webhooks. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized discrete manufacturer runs Plex for production planning, inventory, and financials, and BigCommerce as the primary sales channel for made-to-order components and assemblies. Before the integration, the e-commerce team exported orders from BigCommerce daily and emailed them to production planning, who manually entered each order into Plex by cross-referencing part numbers and customer names. With Plex and BigCommerce connected, each new order flows into Plex automatically within minutes, marked with the customer from the BigCommerce storefront. Production planning sees the order appear in Plex's backlog and can schedule it immediately. When Plex inventory is updated for completed orders, stock levels sync back to BigCommerce so the storefront reflects actual availability and prevents overselling.

What you can do

Map BigCommerce orders into Plex sales orders with customer names and line-item details, synced within minutes via webhook.
Validate BigCommerce webhook signatures using HMAC-SHA256 and the store client secret, and retry failed webhooks with exponential backoff.
Bridge BigCommerce API key and Plex OAuth 2.0 authentication, storing credentials encrypted and refreshing tokens before expiry.
Sync inventory levels from Plex to BigCommerce on a configurable schedule to keep product stock in sync across both systems.
Track webhook and API health with alerts for deactivated webhooks, failed connections, and rate limit backoff.

Questions

How does ml-connector handle BigCommerce webhook signature validation?: ml-connector stores the BigCommerce store client_secret encrypted and validates every incoming webhook using HMAC-SHA256 over the raw request body. The signature is compared in constant time to the X-BC-Signature header. If the signature is invalid, the webhook is rejected with 401 Unauthorized. Valid webhooks are then used to trigger a REST API call to fetch the full order detail, because BigCommerce webhook payloads contain only a type and ID.
What happens if a BigCommerce webhook auto-deactivates?: BigCommerce webhooks auto-deactivate after 90 days of inactivity or 48 hours of delivery failures. ml-connector logs the deactivation event in the audit trail and sends an alert so the integration operator can re-register the webhook. Re-registration is a one-time action in the control plane.
Does Plex role-based access control affect the integration?: Yes. The Plex integration account must have the correct role assigned to write sales orders and read inventory. If a write fails with 403 Forbidden, it indicates the integration account lacks the required role. The Plex administrator must grant the integration account the correct roles in the Plex identity provider.

Connect Plex and BigCommerce

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started