Sage 300 and ShipBob integration

What moves between them

Shipment records from ShipBob flow into Sage 300 as general ledger journal entries, posted to the revenue and COGS accounts mapped to each product. Returns also flow into Sage 300 as reversal entries. Inventory levels change as ShipBob processes shipments and receives inventory, and ml-connector queries ShipBob's inventory endpoint and adjusts Sage 300's stock-on-hand balances by location. Journal batches post on a cadence tied to your daily fulfillment cycles, typically once per day or once per shift depending on volume.

How ml-connector handles it

ml-connector accepts ShipBob OAuth2 credentials or a Personal Access Token and maintains a 1-hour bearer token, refreshing it before expiry. It registers as a webhook listener on ShipBob for order.shipped, return.created, and wro.completed events, receiving HMAC-SHA256 signed event payloads. For each event, it translates the ShipBob order or return into a Sage 300 journal batch entry, looks up the matching GL account and cost center for that product, and POSTs the batch to Sage 300 using HTTP Basic Auth with the stored uppercase username and password. Inventory queries poll ShipBob's inventory endpoint to read current on-hand levels by location and variant, and ml-connector calculates the delta from Sage 300's ICItems and ICItemLocationDetails, then POSTs quantity adjustments as needed. Because Sage 300's username and password must be uppercase and are sent in every request, ml-connector stores them encrypted and validates them at setup time. Payloads are stored with a full audit trail, so if a Sage 300 POST fails, the job can be replayed once the upstream issue is fixed.

A real-world example

A small e-commerce apparel company fulfills orders through ShipBob while maintaining a Sage 300 ERP on-premise for accounting and inventory control. Before the integration, the fulfillment team shipped orders from ShipBob every day while the accounting team imported shipment CSVs into Sage 300 and manually journalized the revenue and COGS entries at day-end, then spent two hours each week reconciling inventory counts from ShipBob against Sage 300's stock records. With Sage 300 and ShipBob connected, each daily batch of shipments automatically posts into Sage 300's general ledger allocated to the correct revenue and COGS accounts, and inventory adjustments flow in real time as ShipBob picks and packs orders. Month-end close arrives with accurate revenue balances and inventory counts, and the manual shipment journaling is gone.

What you can do

• •Post ShipBob shipments into Sage 300 as general ledger journal entries, allocated to the correct revenue and cost of goods sold accounts.
• •Sync ShipBob returns as reversal entries into Sage 300, reducing revenue and increasing inventory.
• •Read current inventory levels from ShipBob's fulfillment centers and adjust Sage 300's stock-on-hand balances to match.
• •Authenticate ShipBob with OAuth2 or Personal Access Token and Sage 300 with HTTP Basic Auth, encrypting and managing both credential sets.
• •Receive ShipBob webhook events in real time, translate them to Sage 300 transactions, and retain a full audit trail of every post and adjustment.

Questions

Which direction does data move between Sage 300 and ShipBob?

Shipment and return records flow from ShipBob into Sage 300 as general ledger journal entries. Inventory levels also flow from ShipBob into Sage 300, where ml-connector calculates the delta and posts quantity adjustments. Sage 300 does not push data back to ShipBob; the integration is primarily read-ShipBob, write-Sage 300.

Why does Sage 300 require uppercase usernames and passwords?

Sage 300 enforces uppercase formatting for HTTP Basic Auth credentials as a security practice on its on-premise API. ml-connector stores the uppercase credentials encrypted, validates them at setup time, and includes them in every request to Sage 300.

How does ml-connector handle ShipBob's OAuth2 token expiry?

ShipBob access tokens expire after 1 hour. ml-connector tracks the token issue time, and before the expiry window closes, it requests a new token using the refresh token. If a request returns a 401 Unauthorized, ml-connector also refreshes immediately. This ensures that token expiry never breaks the integration.