---
schema_version: "1"
id: e8c08da2c334d198cc52dafe0218e3a9f5ad648dfba2c01ec9891b4f08a4afed
title: Shopper Authentication in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_shopper_authentication.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_shopper_authentication.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 78801863fb98fbee61db41b6c54729a7f687e7fd246b7394d66d2cd5c288ad2d
description: Shoppers can register and create accounts on your storefront or they can remain anonymous. For example, to browse your storefront, shoppers aren’t required to log in to their account or even have an account. However, when a shopper creates an account, you now have their information, such as billing address, credit card, and previous orders. Authenticated shoppers can also access certain functionality that’s not available to anonymous shoppers, such as a gift registry and wishlist.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Shopper Authentication in B2C Commerce

Shoppers can register and create accounts on your storefront or they can remain anonymous. For example, to browse your storefront, shoppers aren’t required to log in to their account or even have an account. However, when a shopper creates an account, you now have their information, such as billing address, credit card, and previous orders. Authenticated shoppers can also access certain functionality that’s not available to anonymous shoppers, such as a gift registry and wishlist.

To create an account, the shopper enters a username and password. After registering, a shopper can change their password. Use Business Manager to configure a password policy as the primary security control for shopper authentication. To enhance security, increase password length from eight characters (default) to 10 characters.

Salesforce B2C Commerce supports OAuth2 to authenticate shoppers and obtain information about them from third-party OAuth Providers, such as Google and Facebook. Shoppers must authorize this access. This feature also makes it faster and easier for shoppers to register with and log in to your storefront. Instead of entering personal information, they can log in with an existing account, such as a Google account. Using an existing account gives your storefront permission to retrieve their personal information from that account.

These authentication schemes apply when the storefront goes into production. However, when the storefront is in development or testing, you don't want potential shoppers to find it through a search engine. To prevent this, use Business Manager to restrict access to your development, staging, and production instances to merchants and other people involved in the project.

To do this, enable the `Protection` mode for the storefront and configure a shared username and password. This shared username and password are used for storefront access for internal use, such as for development and testing. Enable storefront protection mode, which is disabled by default.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note The merchant is responsible for shopper authorization.