---
schema_version: "1"
id: 9d2a016b88a953c7668d5a4026d95f46772ba0af38af11abe42d77ac67a74e9f
title: Authentication and Authorization in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_authentication_and_authorization.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_authentication_and_authorization.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1c458aa208f0331acc93dc28f654c94f86b36634bd65d4315910b99506cf23ec
description: Authentication and authorization are key security concepts. To configure security controls, you need access to Business Manager.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Authentication and Authorization in B2C Commerce

Authentication and authorization are key security concepts. To configure security controls, you need access to Business Manager.

- **[Introduction to Roles in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_introduction_to_roles.htm&release=264.0.0&type=5)**  
    In Business Manager, you can perform authentication to determine if the user is who they claim to be. You can also perform authorization to determine if the user has permission to perform the specific action they’re attempting.
- **[Shopper Authentication in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_shopper_authentication.htm&release=264.0.0&type=5)**  
    Shoppers can register and create accounts on your storefront or they can remain anonymous. For example, to browse your storefront, shoppers aren’t required to log in to their account or even have an account. However, when a shopper creates an account, you now have their information, such as billing address, credit card, and previous orders. Authenticated shoppers can also access certain functionality that’s not available to anonymous shoppers, such as a gift registry and wishlist.
- **[User Authentication and Authorization in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_user_authentication_and_authorization.htm&release=264.0.0&type=5)**  
    As an administrator, you configure security controls in Business Manager. You must perform authentication to determine if the Business Manager user is who they claim to be. You can also perform authorization to determine if the user has permission to perform the specific action they’re attempting.
- **[OCAPI Client Authentication and Authorization in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_ocapi_client_authentication_and_authorization.htm&release=264.0.0&type=5)**  
    Open Commerce API (OCAPI) provides a RESTful interface that OCAPI clients consume (custom code). So, what about client authentication and authorization for OCAPI?
- **[WebDAV Authentication and Authorization in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_webdav_authentication_and_authorization.htm&release=264.0.0&type=5)**  
    WebDAV is a protocol that enables you to upload and download data or code files. A merchant sends WebDAV requests to your instance’s WebDAV server. The merchant’s WebDAV client can be a Business Manager user or an API client for machine-to-machine interaction.