Punchout: Enforce Checkout Only for Punchout Sessions

This feature prevents users from completing checkout unless they started their session via a valid PunchOut setup request. It addresses a common issue on storefronts that support both standard login and Punchout: users who log in normally (not from their procurement system) can place orders, but they aren’t returned to the procurement system at the end of the flow.

When enabled, the system checks that the customer has a PunchOutFormPostUrl associated with their session (i.e., they arrived via a proper PunchOutSetupRequest). If that value is missing, checkout is blocked and the user sees a clear message explaining why.

What happens when the session is not a Punchout session?
The punchout plugin overrides the cart warnings and returns the error message:

"You can not checkout out if you have not started with session from Punchout"

This ensures only valid Punchout sessions can place orders, preventing incomplete or misrouted return flows back to procurement.

---

Key Settings

• Checkout only with Punchout (Punchout settings → General)
  What it does: When enabled, only customers who logged in via a PunchOut setup request can place orders.
  How it works: If the customer does not have a PunchOutFormPostUrl value, checkout is blocked with the error message above.
  When to use: Enable this on storefronts where users might access the site both directly and through a procurement system, to ensure correct Punchout behavior.

Note: Message tokens do not expose PunchOutFormPostUrl or customer additional attributes for display. The enforcement happens automatically; there’s no token to surface this value in the UI.

---

Use Cases

• Prevent accidental direct checkout: Stop users who bypass their procurement system from placing orders that won’t return to procurement.

• Improve reliability of Punchout flows: Ensure orders originate from a valid Punchout session to avoid cart loops or failed returns.

• Simplify support: Provide a clear, user-facing message when checkout is blocked due to a non-Punchout session.

---

Step-by-Step Implementation Guide

1. Enable the setting

   1. Open your storefront’s Punchout settings (Connect Plugins > Configure [Connect: Punchout]).
      
      
      
      
      

   2. In the General group, enable Checkout only with Punchout.
      
      
      
      
      

   3. Save your changes.

2. Test the enforcement (non-Punchout user)

   • Log in without initiating from a procurement/Punchout system.

   • Attempt to checkout.

   • You should be blocked with the error:

     "You can not checkout out if you have not started with session from Punchout"

3. Test the enforcement (Punchout user)

   • Start from your procurement system so a proper PunchOutSetupRequest is sent.

   • Confirm the session is established as Punchout (i.e., has a PunchOutFormPostUrl).

   • Proceed to checkout. You should be allowed to place the order.

---

Presetup Info / Required Config

Before enabling this setting, ensure you have:

• A storefront configured for Punchout.

• At least one product available for testing.

• Your procurement system configured to send a proper PunchOut setup request (including BrowserFormPost).