Help us improve
Share bugs, ideas, or general feedback.
From bigcommerce-commerce
Implements BigCommerce security: OAuth/JWT token management, API/webhook auth, CSP, input validation, PCI compliance. Use for hardening integrations or security reviews.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin bigcommerce-commerceHow this skill is triggered — by the user, by Claude, or both
Slash command
/bigcommerce-commerce:bc-securityThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
**Fetch live docs**:
Implements Shopify security best practices for API credential storage, webhook HMAC validation with TypeScript/Express, and access scopes.
Secures Shopify apps via HMAC webhook verification, session token validation, OAuth scope checks, CSP headers, GDPR webhooks, and input sanitization.
Builds BigCommerce apps: single-click OAuth installs, load/uninstall callbacks, connector apps, Script Manager, and App Marketplace submission.
Share bugs, ideas, or general feedback.
Fetch live docs:
site:developer.bigcommerce.com security authentication for auth securitybigcommerce app security best practices for app securitybigcommerce pci compliance for PCI guidance| Token Type | Security Level | Storage |
|---|---|---|
| API Account Token | Highest — full API access | Server-side only, encrypted |
| OAuth App Token | High — scoped access | Server-side, per-store |
| Storefront API Token | Medium — read-only storefront data | Client-side OK (limited scope) |
| Customer Impersonation Token | High — customer data access | Server-side only |
Rate limits prevent abuse:
X-Rate-Limit-Requests-Left headerAlways verify JWTs in Load, Uninstall, and Remove User callbacks:
iss (issuer) matches BigCommerceexp (expiration) — reject expired tokensaud (audience) matches your Client IDstore_hash and user only after verificationstate parameter in OAuth flows to prevent CSRFBigCommerce doesn't sign webhook payloads with HMAC, so:
{ "headers": { "X-Webhook-Secret": "your-shared-secret" } }
store_id matches expected storeshash field) to prevent replay attacksdata.id blindly — verify by fetching the resource via APIWhen your app loads in the BigCommerce admin iframe:
Content-Security-Policy: frame-ancestors 'self' *.bigcommerce.comX-Frame-Options: ALLOW-FROM https://store-{hash}.mybigcommerce.comAdd CSP headers via Script Manager or theme configuration to restrict:
script-src — allowed script sourcesstyle-src — allowed style sourcesimg-src — allowed image sourcesconnect-src — allowed API endpoints{{{raw_html}}} triple-braces only for trusted contentBigCommerce is PCI DSS Level 1 compliant as a platform:
Fetch the BigCommerce security documentation and app review requirements for exact JWT verification patterns, CSP configuration, and current security best practices before implementing.