---
schema_version: "1"
id: 917e0c1d27b7e0b89558a53257047e5008afe777ba821610cf5295434371006e
title: Code Upload in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_code_upload.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_code_upload.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1c968f2866a197ad4ab3cf2a42dbda7283bc4acb0158a789dc02d2f6053a2a71
description: Upload custom code, also known as cartridges, to an instance using UX Studio, or with a file transfer mechanism such as WebDAV over Transport Layer Security (TLS). It’s important that you secure code uploads. Follow these best practices.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Code Upload in B2C Commerce

Upload custom code, also known as cartridges, to an instance using UX Studio, or with a file transfer mechanism such as WebDAV over Transport Layer Security (TLS). It’s important that you secure code uploads. Follow these best practices.

- Use two-factor authentication to upload code to the staging instance. The first factor depends on whether a user or API client performs the code upload. For users, the first factor is a username and password. For API clients, the first factor is an authorization token, minted by Account Manager.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)
    
    Note The API client must present its client-id/client-secret to receive the authorization token. The second factor is always a client certificate.
- Initially upload code into an inactive version on the staging instance.