From bigcommerce-commerce
Implements BigCommerce security: OAuth/JWT token management, API/webhook auth, CSP, input validation, PCI compliance. Use for hardening integrations or security reviews.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin bigcommerce-commerceThis skill is limited to using the following tools:
**Fetch live docs**:
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Fetch live docs:
site:developer.bigcommerce.com security authentication for auth securitybigcommerce app security best practices for app securitybigcommerce pci compliance for PCI guidance| Token Type | Security Level | Storage |
|---|---|---|
| API Account Token | Highest — full API access | Server-side only, encrypted |
| OAuth App Token | High — scoped access | Server-side, per-store |
| Storefront API Token | Medium — read-only storefront data | Client-side OK (limited scope) |
| Customer Impersonation Token | High — customer data access | Server-side only |
Rate limits prevent abuse:
X-Rate-Limit-Requests-Left headerAlways verify JWTs in Load, Uninstall, and Remove User callbacks:
iss (issuer) matches BigCommerceexp (expiration) — reject expired tokensaud (audience) matches your Client IDstore_hash and user only after verificationstate parameter in OAuth flows to prevent CSRFBigCommerce doesn't sign webhook payloads with HMAC, so:
{ "headers": { "X-Webhook-Secret": "your-shared-secret" } }
store_id matches expected storeshash field) to prevent replay attacksdata.id blindly — verify by fetching the resource via APIWhen your app loads in the BigCommerce admin iframe:
Content-Security-Policy: frame-ancestors 'self' *.bigcommerce.comX-Frame-Options: ALLOW-FROM https://store-{hash}.mybigcommerce.comAdd CSP headers via Script Manager or theme configuration to restrict:
script-src — allowed script sourcesstyle-src — allowed style sourcesimg-src — allowed image sourcesconnect-src — allowed API endpoints{{{raw_html}}} triple-braces only for trusted contentBigCommerce is PCI DSS Level 1 compliant as a platform:
Fetch the BigCommerce security documentation and app review requirements for exact JWT verification patterns, CSP configuration, and current security best practices before implementing.