---
schema_version: "1"
id: 3c07b77e1d5f45f1d680f20d3c029a5367c3d93a5fa44a24841ca71017858e0f
title: October 2025
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/b2c_com_api_oct_2025.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.b2c_com_api_oct_2025.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 274e785e8f9a5ba8898f24bd0016090dfd3a47460c42cf36923ed29fa85ce02e
description: SCAPI and SLAS
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# October 2025

SCAPI and SLAS

For more detailed release information, see [B2C Commerce API Release Notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html).

SCAPI:

- With B2C Commerce version 25.10, you can use the [Replications API](https://developer.salesforce.com/docs/commerce/commerce-api/references/replications?meta=Summary) to publish a product, price table, and content asset. Publishing an item is only available from STG to PRD and isn't testable on sandboxes. You will be able to use this API when B2C Commerce version 25.10 is rolled out on PIG instances.
- Improved Hybrid login support for the SameSite cookie parameter:
    - Consistently verifies that the SameSite attribute for the dwsid cookie returned during token calls for Hybrid Auth matches the SameSite attribute for dwsid cookies set in Controller calls.
- Added preference-based response timeout settings for Sandbox instances types:
    - A new [Timeouts API](https://developer.salesforce.com/docs/commerce/commerce-api/references/timeouts?meta=Summary) provides customer self-service timeout configuration. This is only available for B2C Commerce Sandbox instances, but will be rolled out to all instance types in the future.

SLAS:

- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
- Enhanced validation for passwordless login to ensure the provided login ID matches the one used for time-based one-time password (TOTP).