# BigCommerce setup for PopMCP

You end up pasting your store hash (the id in your API path) and the Access Token from a store-level V2/V3 API account created in the BigCommerce control panel.

- Auth: API credentials
- Setup time: 5 min
- API base URL: https://api.bigcommerce.com/stores/{store_hash}/v3
- Credentials screen: https://login.bigcommerce.com/deep-links/manage/settings-list
- Provider docs: https://developer.bigcommerce.com/docs/start/authentication/api-accounts

## Before you begin

- A BigCommerce store on any plan, including a sandbox
- A control panel user with the Create API Accounts permission, such as Store Owner
- A store-level API account rather than an account-level one, because account-level tokens are for multi-store management

## Get your credentials

### 1. Open Store-level API accounts

In the control panel sidebar click Settings, then under the API heading click Store-level API accounts. Skip Account-level API accounts directly below it.

Screen: https://login.bigcommerce.com/deep-links/manage/settings-list

### 2. Create a V2/V3 API token

Click Create API Account and leave Token type on V2/V3 API token. Type a Name of at least four characters, such as `PopMCP`.

### 3. Set the OAuth scopes

Scroll to OAuth scopes and set every resource PopMCP should use to modify. Leave the rest on none, then click Save.

### 4. Copy the access token and store hash

Copy the Access Token from the credentials window, and take the store hash out of the API path. In `https://api.bigcommerce.com/stores/abc123xyz9/v3/` the hash is `abc123xyz9`.

### 5. Paste into PopMCP

Paste the hash into Store hash, or paste the whole API path and let PopMCP extract it. Paste the token into Access token and save.

## Fields PopMCP asks for

- Store hash (storeHash) [required]: The store id in your API Path: https://api.bigcommerce.com/stores/<store-hash>/v3/. Paste just the hash, or the whole API path, and we'll pull it out.
- Access token (accessToken) [required]: BigCommerce control panel → Settings → API → Store-level API accounts → Create. Copy the Access Token (shown once). Grant the scopes you want the MCP to use. Stored encrypted.

## Verify

PopMCP shows BigCommerce as Connected and a test call returns your store's product catalogue. The API account row appears under Settings > API > Store-level API accounts.

## Troubleshooting

### 401 Unauthorized on every call

Cause: The access token is wrong, or the client secret was pasted into the token field. The .txt file lists both and they look similar.

Fix: Re-open the downloaded .txt and copy the value labelled Access Token. If the file is gone, delete the API account and create a new one.

### 403 Forbidden on some tools but not others

Cause: That resource's OAuth scope was left on none, and scopes are immutable after creation.

Fix: Create a fresh API account with the missing scope set to modify, swap the new token into PopMCP, then delete the old account.

### 404 on every endpoint

Cause: The store hash is wrong, often because the store's subdomain was pasted instead of the hash from the API path.

Fix: Use only the segment between /stores/ and /v3/ in the API path, or paste the entire API path and let PopMCP parse it.

### The Client ID and Client Secret fields in PopMCP are missing

Cause: A store-level token authenticates with the X-Auth-Token header alone.

Fix: Nothing to fix. Only the store hash and access token are needed.

### 429 Too Many Requests

Cause: The 30-second request quota for your plan was exhausted.

Fix: Wait for the window in the X-Rate-Limit-Time-Reset-Ms header to elapse. Standard and Plus plans get 150 requests per 30 seconds, Pro gets 450.

---

Source: https://www.docs.popmcp.com/docs/integrations/bigcommerce/