---
schema_version: "1"
id: 637053765d0c4eb024d45791d57f41f58fbe5b3a3672402728181ba1324d35fe
title: Configure SSO Using Account Manager as the IdP
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_account_manager_idp.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_account_manager_idp.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2ff7a911dc8fafae6dd84f369a6bffc6dd156ea959becc41147f7e1dee623675
description: If you’re using Account Manager as an IdP, complete these tasks for the B2C Commerce Merchant Agent to work.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Configure SSO Using Account Manager as the IdP

If you’re using Account Manager as an IdP, complete these tasks for the B2C Commerce Merchant Agent to work.

Make sure that you have access to Business Manager and the connected Salesforce org.

## Add an API Client in Account Manager

The API client provides the Consumer Key and Consumer Secret that Salesforce uses to communicate with Account Manager.

1. Log in to Account Manager at https://account.demandware.com/.
2. Go to the **API Client** section and click **Add API Client**.
3. Fill in the client details:
    1. **Display Name**: Enter a recognizable name (for example, "Salesforce SSO – Your Org Name")
    2. **Password**: Set a strong secret. This value becomes your Consumer Secret.
    3. **Organizations**: Select the organizations that this client can access.
    4. **Token Endpoint Auth Method**: Select client\_secret\_basic.
    5. **Redirect URIs**: Leave this entry blank for now. You add the Salesforce callback URL later.
4. Click **Save**.
5. Record these values. You use them when you create the Auth Provider:
    1. **Consumer Key**: The Client ID (UUID) shown by Account Manager
    2. **Consumer Secret**, which is the password you set earlier.

![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_warning.png)

Warning Assign this API client only to a single organization. Salesforce is deprecating multi-organization assignments, so Account Manager blocks them and removes existing ones. To use Salesforce SSO for more organizations, create a separate API client for each organization.

## Add Account Manager as an Auth Provider

In your Salesforce org, add Account Manager as an Auth Provider so your users can log in to Salesforce with single sign-on (SSO).

1. Log in to your Salesforce org.
    
    Log in at login.salesforce.com or at your My Domain URL, if your admin configured it, for example, https://company.my.salesforce.com.
2. In the top-right corner, click ![Setup](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/setup_icon_no_border.png) then select **Setup**.
3. In the Quick Find box, enter **Auth Providers** and select **Auth. Providers**.
4. Click **New**.
5. Fill in the Authentication Provider Edit form:
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col>
                <col>
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d75810e246">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d75810e249">Value</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Provider Type</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 ">Commerce Cloud Account Manager</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Name</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 ">Account Manager or any descriptive name</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">URL Suffix</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 ">Account_Manager (used in the callback URL)</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Consumer Key</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 ">The Client ID from your API Client</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Consumer Secret</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 ">
                    <p>The password you set for your API Client. </p>
                    <p style="margin-bottom:0;">Keep the secret private.
                      Store it in a secure place, such as a secrets manager. Don't commit the secret
                      to source control or share it over insecure channels.</p>
                  </td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Authorize Endpoint URL</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 "><code>https://account.demandware.com/dwsso/oauth2/authorize</code></td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Token Endpoint URL</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 "><code>https://account.demandware.com/dwsso/oauth2/access_token</code></td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">User Info Endpoint URL</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 "><code>https://account.demandware.com/dw/rest/v1/users/current</code></td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Link to messaging components</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 ">Leave deselected.</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e246 ">Use Salesforce MFA for this SSO Provider</td>

                  <td data-label="Value" class="slds-cell-wrap" style="vertical-align:top;" headers="d75810e249 ">Leave deselected unless your security policy requires it.</td>

                </tr>
              </tbody>
            </table>
6. Click **Save**.
    
    The **Salesforce Configuration** section appears at the end of the Auth Provider detail page.
7. Copy the **Callback URL** and the **Single Sign-On Initialization URL** from the configuration details. The Callback URL format is: `https://<your-domain>.my.salesforce.com/services/authcallback/Account_Manager`
8. Register the Callback URL in Account Manager.
    1. Return to Account Manager and open the API Client that you created earlier.
    2. In the **Redirect URIs** field, paste the Callback URL you copied from Salesforce.
    3. Click **Save**.
9. Verify the connection.
    1. Paste the **Single Sign-On Initialization** URL into a new browser tab.
    2. Log in with your Account Manager credentials.
        
        A successful login confirms that you configured the Auth Provider correctly.