Access runs through an API account created under Settings, generating a client ID, client secret, and access token scoped to exactly the permissions you grant it, orders read-only, catalog read/write, whatever a given integration actually needs. That scoping matters: a token with broader access than necessary is a bigger liability if it ever leaks.
BigCommerce runs multiple API generations side by side. The v3 Catalog API handles products, categories, and variants with a more modern structure; some older resources still sit on the legacy v2 API, and a store's history determines which version a given integration actually needs to touch. Rate limits scale with your plan tier, visible directly in the response headers, which matters for anything syncing a large catalog in bulk.
BigCommerce also has native webhook support: subscribe to a topic like `store/order/created` or `store/product/updated`, and BigCommerce POSTs the event to your endpoint the moment it happens, the same event-driven pattern WooCommerce uses, just under a different topic naming scheme.