BigCommerce
Connect BigCommerce to manage products, categories, orders, customers, carts, checkouts, and coupons for your store.
You end up pasting your store hash (the id in your API path) and the Access Token from a store-level V2/V3 API account created in the BigCommerce control panel.
- Setup time
- 5 min
- Auth
- API credentials
- API base URL
- https://api.bigcommerce.com/stores/{store_hash}/v3
- Rate limits
- Quota refreshes every 30 seconds: 150 requests on Standard and Plus, 450 on Pro, and by plan and resource on Enterprise.
Before you begin
- A BigCommerce store on any plan, including a sandbox
- A control panel user with the Create API Accounts permission, such as Store Owner
- A store-level API account rather than an account-level one, because account-level tokens are for multi-store management
Get your credentials
Open Store-level API accounts
In the control panel sidebar click Settings, then under the API heading click Store-level API accounts. Skip Account-level API accounts directly below it.
Store-level API accounts
Tokens that read and write data for this store only.
| Name | Client ID | Type | Created | Status |
|---|---|---|---|---|
| Warehouse syncCreated by owner@acme.com | abc1****xy9 | V2/V3 API token | Mar 4, 2026 | Active |
| Old ERP bridgeCreated by owner@acme.com | 7fd2****k41 | V2/V3 API token | Nov 18, 2025 | Revoked |
Store-level and Account-level API accounts are separate lists under Settings > API.
Create a V2/V3 API token
Click Create API Account and leave Token type on V2/V3 API token. Type a Name of at least four characters, such as PopMCP.
Create API Account
Name the account, then choose what it is allowed to touch.
API path is read-only. The segment between /stores/ and /v3/ is your store hash.
Set the OAuth scopes
Scroll to OAuth scopes and set every resource PopMCP should use to modify. Leave the rest on none, then click Save.
Create API Account
Coupons and promotions sit under Marketing, not Products.
Copy the access token and store hash
Copy the Access Token from the credentials window, and take the store hash out of the API path. In https://api.bigcommerce.com/stores/abc123xyz9/v3/ the hash is abc123xyz9.
Create API Account
A .txt file with these four values downloads automatically in Chrome, Edge and Firefox. The token is never shown again.
Paste into PopMCP
Paste the hash into Store hash, or paste the whole API path and let PopMCP extract it. Paste the token into Access token and save.
Connect in PopMCP
Open your workspace, choose BigCommerce in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Store hashtext | The store id in your API Path: https://api.bigcommerce.com/stores/<store-hash>/v3/. Paste just the hash, or the whole API path, and we'll pull it out. |
| Access tokensecret | BigCommerce control panel → Settings → API → Store-level API accounts → Create. Copy the Access Token (shown once). Grant the scopes you want the MCP to use. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against BigCommerce immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows BigCommerce as Connected and a test call returns your store's product catalogue. The API account row appears under Settings > API > Store-level API accounts.
Troubleshooting
401 Unauthorized on every call
Why: The access token is wrong, or the client secret was pasted into the token field. The .txt file lists both and they look similar.
Fix: Re-open the downloaded .txt and copy the value labelled Access Token. If the file is gone, delete the API account and create a new one.
403 Forbidden on some tools but not others
Why: That resource's OAuth scope was left on none, and scopes are immutable after creation.
Fix: Create a fresh API account with the missing scope set to modify, swap the new token into PopMCP, then delete the old account.
404 on every endpoint
Why: The store hash is wrong, often because the store's subdomain was pasted instead of the hash from the API path.
Fix: Use only the segment between /stores/ and /v3/ in the API path, or paste the entire API path and let PopMCP parse it.
The Client ID and Client Secret fields in PopMCP are missing
Why: A store-level token authenticates with the X-Auth-Token header alone.
Fix: Nothing to fix. Only the store hash and access token are needed.
429 Too Many Requests
Why: The 30-second request quota for your plan was exhausted.
Fix: Wait for the window in the X-Rate-Limit-Time-Reset-Ms header to elapse. Standard and Plus plans get 150 requests per 30 seconds, Pro gets 450.