Salesforce Docs Portal

Authorization Scopes Catalog

Scopes control which B2C Commerce endpoints a token can access and define the permissions and operations a token can perform, so that only authorized operations are allowed.

Scopes use the format sfcc.{family}[.rw]. The optional .rw suffix indicates read and write permissions.

To assign scopes to tokens and configure them based on your storefront needs:

  1. Understand the capabilities of your storefront and what shoppers can do.
  2. Determine the API families with which your storefront needs to interact and the specific actions needed: Shopper APIs, SCAPI Admin APIs, and SLAS Admin APIs.
  3. Identify the required scopes using the following tables.
    • For security reasons, limit scopes to the minimum you need.
    • Optimize the size of your JSON Web Token (JWT). Scopes make up a large portion of the SLAS JWT, and in many cases, this SLAS token is stored as a cookie and is passed back-and-forth in both requests and responses.
    • To reduce JWT size, use the sfcc.shopper-standard scope. For more information, see Standard Shopper Scope. tip: For each selected scope, configure the specific permissions to avoid redundancy. If you include the .rw version for a scope, avoid using the read-only counterpart, as it's redundant and can make the token unnecessarily bulky.
    • Include only scopes for the applicable API family. For example, don't include SCAPI Admin API scopes in a SLAS JWT.
  4. Configure your token with the correct scopes:
  5. Save the token configuration. To test it, make API calls. A successful call returns a 200 response. A 401 or 403 response indicates a missing or incorrect scope.

Default Scopes

By default, the following SLAS scopes are assigned:

sfcc.shopper-baskets-orders.rw
sfcc.shopper-categories
sfcc.shopper-customers.login
sfcc.shopper-customers.register
sfcc.shopper-discovery-search
sfcc.shopper-gift-certificates
sfcc.shopper-myaccount.addresses.rw
sfcc.shopper-myaccount.baskets
sfcc.shopper-myaccount.orders
sfcc.shopper-myaccount.paymentinstruments.rw
sfcc.shopper-myaccount.productlists.rw
sfcc.shopper-myaccount.rw
sfcc.shopper-configurations
sfcc.shopper-product-search
sfcc.shopper-productlists
sfcc.shopper-products
sfcc.shopper-promotions
sfcc.shopper-stores
sfcc.shopper-experience

List of SCAPI Shopper API Scopes

These scopes are only useful inside a SLAS JWT.

To configure tokens for use with the Shopper APIs, see Authorization for Shopper APIs.

Scope API Family API Name Purpose
sfcc.shopper-agents.rw Shopper Shopper Agents Initialize Shopper Agent session.
sfcc.shopper-baskets-orders Checkout Shopper Baskets Read baskets and orders from a shopper perspective.
sfcc.shopper-baskets-orders.rw Checkout Shopper Baskets Create, read, update, and delete an order, including shipping and tax information.
sfcc.shopper-categories Product Shopper Products Read categories to be displayed on a storefront for shoppers.
sfcc.shopper-configurations Configuration Shopper Configurations Retrieve global and site-specific configuration details.
sfcc.shopper-consents Shopper Shopper Consents Read Shopper Consents.
sfcc.shopper-consents.rw Shopper Shopper Consents Create, read, update, and delete Shopper Consents.
sfcc.shopper-context Shopper Shopper Context Read Shopper Context.
sfcc.shopper-context.rw Shopper Shopper Context Create, read, update, and delete Shopper Context.
sfcc.shopper-custom-objects Custom Object Shopper Custom Objects Read all custom object information.
sfcc.shopper-custom-objects.{object-type} Custom Object Shopper Custom Objects Read custom object information. Access can be restricted at the {object-type} level. This extends the standard objects provided by B2C Commerce.
sfcc.shopper-customers.login Customer Shopper Customers Log in a shopper.
sfcc.shopper-customers.register Customer Shopper Customers Register a shopper.
sfcc.shopper-delivery-estimates Product Shopper Delivery Estimates Read carrier-calculated delivery date estimates for a product at a destination postal code, for example, to show "Arrives by" messaging on product detail pages.
sfcc.shopper-experience Experience Shopper Experience Read access for assets created in Page Designer.
sfcc.shopper-experience.contents Experience Shopper Experience Read content assets available on a storefront.
sfcc.shopper-experience.folders Experience Shopper Experience Read content folders used to organize storefront content assets.
sfcc.shopper-experience.pages Experience Shopper Experience Read pages created in Page Designer.
sfcc.shopper-experience.qualifiers Experience Shopper Experience Resolve qualifiers for customer groups, campaign promotions, and data binding contexts.
sfcc.shopper-gift-certificates Pricing Shopper Gift Certificates Read gift certificates from a shopper perspective.
sfcc.shopper-myaccount Customer Shopper Customers Read all data in a shopper account.
sfcc.shopper-myaccount.addresses Customer Shopper Customers Read shopper addresses.
sfcc.shopper-myaccount.addresses.rw Customer Shopper Customers Create, read, update, and delete addresses in a shopper account.
sfcc.shopper-myaccount.baskets Customer Shopper Customers Read a shopper’s baskets.
sfcc.shopper-myaccount.orders Customer Shopper Customers Read a shopper’s orders.
sfcc.shopper-myaccount.paymentinstruments Customer Shopper Customers Read a shopper’s payment instruments.
sfcc.shopper-myaccount.paymentinstruments.rw Customer Shopper Customers Create, read, update, and delete payment instruments in a shopper account.
sfcc.shopper-myaccount.productlists Customer Shopper Customers Read wishlists associated with a shopper account.
sfcc.shopper-myaccount.productlists.rw Customer Shopper Customers Create, read, update, and delete wishlists associated with a shopper account.
sfcc.shopper-myaccount.rw Customer Shopper Customers Create, read, update, and delete all data in a shopper account.
sfcc.shopper-product-search Search Shopper Search Search for products and product suggestions.
sfcc.shopper-productlists Customer Shopper Customers Read public product lists or wishlists.
sfcc.shopper-products Product Shopper Products Read products merchandised and available to be sold on a particular site.
sfcc.shopper-promotions Pricing Shopper Promotions Read promotions from a shopper perspective.
sfcc.shopper-seo Site Shopper SEO Read SEO-related information.
sfcc.shopper-stores Store Shopper Stores Search for and read details on stores.

List of SCAPI Admin API Scopes

These scopes are only useful inside an Account Manager JWT.

To configure tokens for use with the SCAPI Admin APIs, see Authorization for Admin APIs.

Scope API Family API Name Purpose
sfcc.analytics Intelligence Analytics Access analytics subject areas, metadata, and query operations.
sfcc.catalogs Product Catalogs Read catalog information.
sfcc.catalogs.rw Product Catalogs Create, read, update, and delete catalogs.
sfcc.cdn-zones CDN Zones CDN Zones Read information related to CDN Zones.
sfcc.cdn-zones.rw CDN Zones CDN Zones Create, read, update, and delete information related to CDN Zones.
sfcc.consents Customer Consents Read customer consent preferences.
sfcc.consents.rw Customer Consents Create, read, update, and delete customer consent preferences.
sfcc.cors-preferences Configuration CORS Preferences Read Cross-Origin Resource Sharing (CORS) preferences.
sfcc.cors-preferences.rw Configuration CORS Preferences Create, read, update, and delete Cross-Origin Resource Sharing (CORS) preferences.
sfcc.custom-apis DX Custom APIs Read resolved Custom API endpoints and their registration status (active/not_registered), including error reasons for failed registrations.
sfcc.custom-apis.rw DX Custom APIs Read endpoints and perform admin-level management actions for Custom APIs (read/write when available).
sfcc.customergroups Customer Customer Groups Read customer groups.
sfcc.customergroups.rw Customer Customer Groups Create, read, update, and delete customer groups.
sfcc.customerlists Customer Customers Read customer list associated with a site.
sfcc.customerlists.rw Customer Customers Create, read, update, and delete customer lists associated with a site.
sfcc.experiences Experience Experiences Read merchandiser experiences.
sfcc.experiences.rw Experience Experiences Create, read, update, and delete merchandiser experiences.
sfcc.gift-certificates Pricing Gift Certificates Read gift certificates.
sfcc.gift-certificates.rw Pricing Gift Certificates Create, read, update, and delete gift certificates.
sfcc.granular-replications Administration Replications Read replication information.
sfcc.granular-replications.rw Administration Replications Create, read, update, and delete replications.
sfcc.inventory-lists Inventory Inventory Lists Read inventory lists.
sfcc.inventory-lists.rw Inventory Inventory Lists Create, read, update, and delete inventory lists.
sfcc.inventory.availability Inventory Inventory Availability Read availability. Account Manager Authentication.
sfcc.inventory.availability.rw Inventory Inventory Availability Create, read, update, and delete availability. Account Manager Authentication.
sfcc.inventory.impex-graphs Inventory Inventory Impex Read location graph exports. Account Manager Authentication.
sfcc.inventory.impex-inventory Inventory Inventory Impex Read inventory exports. Account Manager Authentication.
sfcc.inventory.impex-inventory.rw Inventory Inventory Impex Read inventory imports. Account Manager Authentication.
sfcc.inventory.reservations Inventory Inventory Reservation Read reservation information. Account Manager Authentication.
sfcc.inventory.reservations.rw Inventory Inventory Reservation Create, read, update, and delete reservations. Account Manager Authentication.
sfcc.jobs Administration Jobs Read job information.
sfcc.jobs.rw Administration Jobs Create, read, update, and delete jobs.
sfcc.metrics Observability Metrics Read metrics and observability data.
sfcc.object-definitions Configuration Object Definitions Read object definitions.
sfcc.object-definitions.rw Configuration Object Definitions Create, read, update, and delete object definitions.
sfcc.orders Checkout Orders Read orders from a management perspective.
sfcc.orders.rw Checkout Orders Create, read, update, and delete an existing order, for example, with a status update.
sfcc.preferences Configuration Preferences Read site and environment-specific settings.
sfcc.price-books Pricing Price Books Read price books.
sfcc.price-books.rw Pricing Price Books Create, read, update, and delete price books.
sfcc.products Product Products Read products assigned to a catalog.
sfcc.products.rw Product Products Create, read, update, and delete products from a catalog.
sfcc.promotions Pricing Promotions Read campaigns, coupons, promotions, and assignments.
sfcc.promotions.rw Pricing Promotions Create, read, update, and delete campaigns, coupons, promotions, and assignments.
sfcc.roles Administration Roles Read roles.
sfcc.roles.rw Administration Roles Create, read, update, and delete roles.
sfcc.scapi-schemas DX SCAPI Schemas Read SCAPI schema registry.
sfcc.scripts DX Scripts Read scripts.
sfcc.scripts.rw DX Scripts Create, read, update, and delete scripts.
sfcc.seo Site SEO Read SEO configurations.
sfcc.seo.rw Site SEO Create, read, update, and delete SEO configurations.
sfcc.sites Configuration Sites Read site information.
sfcc.sites.rw Configuration Sites Create, read, update, and delete site information.
sfcc.source-codes Pricing Source Code Groups Read source codes.
sfcc.source-codes.rw Pricing Source Code Groups Create, read, update, and delete source codes.
sfcc.store-redirect-mappings Site Store Redirect Mappings Read store redirect mappings.
sfcc.store-redirect-mappings.rw Site Store Redirect Mappings Create, read, update, and delete store redirect mappings.
sfcc.storefront.deployments.rw Deployment Deployments Upload, deploy, and get a bundle and all bundles. Get one or all deployments.
sfcc.storefront.environments.rw Environment Environments Create, clone, delete, and edit environments, access control headers, redirects. List environments. Create cache invalidation.
sfcc.storefront.storefronts.rw Storefront Storefronts Create, get, edit, and delete storefronts.
sfcc.stores Store Stores Read store information.
sfcc.timeouts Configuration Timeouts Read timeout configuration.
sfcc.timeouts.rw Configuration Timeouts Create, read, update, and delete timeout configuration.
sfcc.users Administration Users Read user information.
sfcc.users.rw Administration Users Create, read, update, and delete users.

List of SLAS Scopes

Scope API Family API Name Purpose
sfcc.pwdless_login Shopper Shopper Login Allow users with a B2C Commerce profile to request a token by email that can be used to log in without a password even when their identity provider (Salesforce) is unavailable.
sfcc.session_bridge Shopper Shopper Login Allow session bridging.
sfcc.ta_ext_on_behalf_of Shopper Shopper Login Call trusted agent endpoints.
sfcc.ts_ext_on_behalf_of Shopper Shopper Login Call trusted system endpoints.
sfcc.shopper-mcpagent Shopper Shopper Login Allow access to the B2C Commerce Model Context Protocol (MCP) Shopper Service from an AI Agent, for example, Claude or ChatGPT.

Example Scopes

Here's an example set of scopes required for a shopping application (such as a PWA Kit storefront):

sfcc.shopper-baskets-orders.rw
sfcc.shopper-categories
sfcc.shopper-customers.login
sfcc.shopper-customers.register
sfcc.shopper-gift-certificates
sfcc.shopper-myaccount.rw
sfcc.shopper-product-search
sfcc.shopper-productlists
sfcc.shopper-products
sfcc.shopper-promotions
sfcc.shopper-stores