---
schema_version: "1"
id: b4cd86c16806f41ea9db9a8e4a9806cb089cb3907de2e2a96dbd3fa7e5a53629
title: WebDAV Authentication and Authorization in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_webdav_authentication_and_authorization.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_webdav_authentication_and_authorization.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e81e81839e47ce922d6925e5d374cbe11a93a88e58e30ca5f5cd2fbe3e6af513
description: WebDAV is a protocol that enables you to upload and download data or code files. A merchant sends WebDAV requests to your instance’s WebDAV server. The merchant’s WebDAV client can be a Business Manager user or an API client for machine-to-machine interaction.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# WebDAV Authentication and Authorization in B2C Commerce

WebDAV is a protocol that enables you to upload and download data or code files. A merchant sends WebDAV requests to your instance’s WebDAV server. The merchant’s WebDAV client can be a Business Manager user or an API client for machine-to-machine interaction.

When the merchant's WebDAV client is a Business Manager user, such as Cyberduck, Salesforce B2C Commerce performs authentication using Basic Auth (username and password). To specify authorization rules in Business Manager, configure per-folder rules in the Roles module (WebDAV Permissions tab).

When the merchant’s WebDAV client is an API client, B2C Commerce performs authentication using an authorization token minted by Account Manager. To get an authorization token, the API client presents its client-id and client-secret to Account Manager. To specify authorization rules in Business Manager, configure per-folder rules in the WebDAV Client Permissions module.

Additionally, the OAuth 2.0 Authorization Code Grant can be used for WebDAV. For more information, see the [Authorization Code Grant](http://tools.ietf.org/html/rfc6749#section-1.3.1) section in the Internet Engineering Task Force (IETF) specification. In this scenario, your user on the Account Manager needs to have the role _Business Manager Administrator_ or _Business Manager User_ assigned together with a tenant filter, which matches the instance you will use the OAuth token for.