---
schema_version: "1"
id: a159e4f853636dfda7ba268f31f3ea1f00bb9b39b14265fff8adf49a522a1a3b
title: Authorization for Shopper APIs
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/authorization-for-shopper-apis.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization-for-shopper-apis.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 9bfb0a1bde2839bf644808b7350d2b186ad6ee8c980af9f6230f11c28bdb015a
products:
  - Composable Storefront
  - Salesforce APIs
---
# Authorization for Shopper APIs

Learn how to set up the Shopper Login and API Access Service (SLAS) so that you can request access tokens for Shopper APIs.

**important:** Shopper APIs are secured with the Shopper Login and API Access Service (SLAS), but SCAPI Admin APIs are secured with Account Manager (AM) instead. This guide _only_ covers how to access the Shopper APIs. To learn how to access the SCAPI Admin APIs, see [Authorization for Admin APIs](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization-for-admin-apis.md).

To get you up and running as fast as possible, the instructions provided here use a web application called the SLAS Admin UI. If you require additional configuration options or are building automated setup tools, also use the [SLAS Admin API](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=slas-admin:Summary) instead of the UI.

## SLAS Admin UI\: Set Up User Roles and Filters

To do this task, you need:

- Your AM token
- The **Account Administrator** role in Account Manager. If you get stuck, ask an administrator on your team for help or contact Support.

For each user performing the SLAS administration tasks described in this guide, follow these steps to set up their roles and filters:

1. Log in to [Account Manager](https://account.demandware.com/).
2. Click **User** from the left navigation.
3. Click the user’s ID.
4. Scroll down to **Roles** and click **Add.**

   ![Screenshot showing interface for adding new SLAS roles and permissions](https://developer.salesforce.com/docs/media/commerce-api/slas-roles-add.png '{"class": "image-lg"}')

5. Enter "slas" in the filter search box.
6. (If you see no results, the role has likely been added already, so click **Cancel** and skip to step 9.)
7. Select **SLAS Organization Administrator**.

   ![Screenshot showing form for creating new SLAS role with permissions](https://developer.salesforce.com/docs/media/commerce-api/slas-add-new-role.png '{"class": "image-sm"}')

8. Click **Add**.
9. Look for the **SLAS Shopper Admin API** category with the **SLAS Organization Administrator** role below it.
10. Click the filter button next to the **SLAS Organization Administrator** role.

    ![Screenshot of SLAS roles filtering and search interface](https://developer.salesforce.com/docs/media/commerce-api/slas-roles-filters.png '{"class": "image-lg"}')

11. Select an organization.
12. Select the hostnames for specific B2C Commerce instances that you want to configure. Also select **All Sandboxes** instead of selecting each sandbox individually.
13. Click **Add**.

    ![Screenshot showing interface for adding SLAS filters and criteria](https://developer.salesforce.com/docs/media/commerce-api/slas-filters-add.png '{"class": "image-sm"}')

14. Scroll down to the bottom of the page.
15. Click **Save**.

Now log in to the SLAS Admin UI. (It can take up to 15 minutes for role changes to propagate and take effect.)

![Screenshot of SLAS Admin UI interface showing client configuration options and navigation menu](https://developer.salesforce.com/docs/media/commerce-api/slas-admin-ui.png '{"class": "image-lg"}')

## SLAS Admin UI\: Create a SLAS Client

The easiest way to create a SLAS client is to use the SLAS Admin UI. To access the SLAS Admin UI, replace `{short-code}` in the following URL with the short code used by your B2C Commerce instances:

```text
https://{short-code}.api.commercecloud.salesforce.com/shopper/auth-admin/v1/ui/
```

Create a private client or append a redirect URI with the [B2C CLI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guides/b2c-developer-tooling.md):

```bash
# Requires the SLAS Organization Administrator role for the target instance.
export SFCC_SHORTCODE='your-short-code'

npx @salesforce/b2c-cli slas client create \
  --user-auth --tenant-id abcd_001 \
  --name 'Mobile-App-Client' \
  --channels RefArch \
  --scopes sfcc.shopper-products,sfcc.shopper-product-search \
  --redirect-uri 'http://localhost:3000/callback'

# Append a redirect URI to an existing client.
npx @salesforce/b2c-cli slas client list \
  --user-auth --tenant-id abcd_001

npx @salesforce/b2c-cli slas client update your-slas-client-id \
  --user-auth --tenant-id abcd_001 \
  --redirect-uri 'https://www.example.com/callback'
```

To learn more about B2C Commerce short codes, see the [Base URL and Request Formation](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/base-url.md) guide.

**note:** If you create Storefront Next in Business Manager, the automated setup creates a private SLAS client ID and secret for you. See [Create Storefront Next in Business Manager with a GitHub Repository](https://developer.salesforce.com/docs/commerce/sfnext/guides/sfnext-quick-start-create-bm-github.md) or [Create Storefront Next in Business Manager with Local Code](https://developer.salesforce.com/docs/commerce/sfnext/guides/sfnext-quick-start-create-bm.md).

Repeat these steps to create a SLAS client for each B2C Commerce instance that requires access to Shopper APIs:

1. Log in to the SLAS Admin UI using your Account Manager credentials.
2. From the top navigation, click **Clients**.
3. Click **Add Client**.
4. Click **Choose Tenant...** and select a B2C Commerce instance.
5. Select an app type with the “Which App Type will be used?” field:

   - Choosing **PWA Kit or SFRA or Mobile** creates a public client (no secret generated).
   - Choosing **BFF or Web App** creates a private client (secret generated automatically).

6. Click **Submit**.

Now use your SLAS client to request an access token for Shopper APIs.

If your app type is **BFF or Web App** (private client), the automatically generated secret is displayed at the top of the results page.

![Success confirmation screen for adding a new SLAS private client with client details](https://developer.salesforce.com/docs/media/commerce-api/slas-private-client-add-success.png)

To initialize an Agentforce session, obtain a SLAS shopper access token that includes the `sfcc.shopper-agents.rw` scope, and then call the [Shopper Agents API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-agents?meta=Summary) with the `sessionInitKey` received at session start.
The Shopper Agent API starts the Agentforce session and associates it with the shopper context that `sessionInitKey` references. It doesn't move profile or basket data. Any access to shopper data continues via standard Shopper APIs, governed by your SLAS token’s scopes.

**important:** A secret can only be displayed once for security reasons, so be sure to copy it and save it in a secure location whenever you create a client for a BFF or Web App.

To generate a new secret for an existing client:

1. From the top navigation, click **Clients**.
2. Click the **Edit** link next to the client ID that you created earlier.
3. Change the app type to **PWA Kit or SFRA or Mobile**.
4. Click **Save**.
5. Click the **Edit** button.
6. Change the app type back to **BFF or Web App**.
7. Click **Save**.
8. Copy the secret at the top of the results page.

<!-- ### Client Secret Management and Rotation

Client secret rotation for SLAS enables secure, nondisruptive rotation of private client secrets. You can simultaneously maintain two active secrets, a primary and a secondary, and rotate them without service interruption. This rotation reduces the risks associated with static keys and aligns with modern credential management best practices.

To rotate a client secret in the SLAS Admin UI:

1. From the top navigation, click **Clients**.
2. Click **Edit** for the client you want to update.
3. Select **Do Secret Rotation**.

![Screenshot showing SLAS secret rotation setting for a client](https://developer.salesforce.com/docs/media/commerce-api/slas-do-secret-rotation.png '{"class": "image-md"}')

4. Before you proceed, make sure that you understand the results of client secret rotation. After you rotate a client secret:
   - A new primary secret is generated and displayed.
   - The current primary secret (`Secret`) becomes the secondary secret (`Secret2`).
   - Both secrets remain active for authentication.
   - If there’s an existing secondary secret (because you’ve rotated this secret before), it gets overwritten and is no longer valid.
5. Click **Acknowledge** to confirm that you want to rotate the client’s secrets.
6. Click **Save** to rotate the secret. If you’re not ready for changes to be applied immediately, click **Cancel** to discard your edits.
7. Copy and securely store the new primary secret value.
   :::important
   The full secret value is displayed only once during rotation. Make sure that you copy and securely store it before leaving the page.
   :::
8. Update your application configuration with the new primary secret.

Both secrets remain valid for authentication until the next rotation cycle, when the secondary secret gets replaced and invalidated. The UI displays a mask with the last three characters of each secret for identification purposes while maintaining security. For example, `**ABC`.

This screenshot shows a client with one active secret. Following secret rotation, `**REY` moves to the empty `Secret2` field, and a new primary secret populates the `Secret` field.

![Screenshot showing the list of active secrets for a client](https://developer.salesforce.com/docs/media/commerce-api/slas-client-secrets.png '{"class": "image-md"}')
-->

## Extra Steps for Phased Rollouts of PWA Kit

If you’re planning to do a [phased rollout](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/phased-headless-rollouts.html) of a PWA Kit experience, you must also create a redirect URI and associate it with your API client.

To create the redirect URI, replace `PLACEHOLDER_HOSTNAME` and `PLACEHOLDER_SITE_ID` in the following string with actual values for your B2C Commerce instance:

```text
https://PLACEHOLDER_HOSTNAME/on/demandware.store/Sites-PLACEHOLDER_SITE_ID-Site/default/SLASCallback-RetrieveCode
```

To associate the redirect with your API client, follow these steps in the SLAS Admin UI:

1. From the top navigation, click **Clients**.
2. Click the **Edit** link next to the client ID that you created earlier.

   ![SLAS client edit interface displaying client configuration fields and options](https://developer.salesforce.com/docs/media/commerce-api/slas-client-edit.png)

3. In the redirect field, append a `|` character followed by the redirect URI that you just created.

   ![SLAS client redirect URI configuration screen showing redirect URL settings and validation](https://developer.salesforce.com/docs/media/commerce-api/slas-client-edit-redirect.png)

4. Click **Save**.

## Advanced\: SLAS Admin API

**note:** If you already created your SLAS clients using the SLAS Admin UI, skip this section.

The SLAS Admin API offers an alternative to the SLAS Admin UI that makes it easier to automate SLAS administration tasks, such as creating public and private clients. The API also provides access to a wider range of configuration options.

### Get a SLAS Admin Token

To access the SLAS Admin API, use the SLAS Admin UI to get an admin token:

1. Log in to the SLAS Admin UI.
2. Click **Token** from the top navigation.
3. Click **Copy Admin Token to Clipboard**. (The token will expire after 30 minutes.)

![Screenshot showing SLAS admin token configuration interface with token details and settings](https://developer.salesforce.com/docs/media/commerce-api/slas-admin-token.png)

**important:** An admin token is not the same as a SLAS access token. An admin token can only be used to access the SLAS Admin API, not Shopper APIs.

### Set Environment Variables

To form your API requests correctly, it helps to set some environment variables first.

**note:** If you’re not using a Unix-based operating system, adapt the commands for setting environment variables or manually replace the variables later in the `curl` command provided.

To store the admin token, replace `{clipboard_contents}` in the following command by pasting the token that you just copied from the SLAS Admin UI:

```bash
export "SFCC_ACCESS_TOKEN={clipboard_contents}"
```

Before running the next series of commands, replace `zzte`, `053`, and `kv7kzm78` with your realm ID, instance ID, and shortcode. To learn more about these identifiers, including how to look them up in Business Manager, see the [Base URL and Request Formation](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/base-url.md) guide.

```bash
export "SFCC_REALM_ID=zzte"
export "SFCC_INSTANCE_ID=053"
export "SFCC_SCAPI_TENANTID=${SFCC_REALM_ID}_${SFCC_INSTANCE_ID}"
export "SFCC_SCAPI_SHORTCODE=kv7kzm78"
```

### Create a SLAS Tenant

Now that your environment variables are set, start making requests to the SLAS Admin API. To create a SLAS tenant (or update an existing one) and associate it with a B2C Commerce instance, make a request to the `tenants` endpoint like this:

```bash
curl "https://$SFCC_SCAPI_SHORTCODE.api.commercecloud.salesforce.com/shopper/auth-admin/v1/tenants/$SFCC_SCAPI_TENANTID" \
--request 'PUT' \
--header 'Content-Type: application/json' \
--header "Authorization: Bearer $SFCC_ACCESS_TOKEN" \
--data-raw '{
    "instance": "'"$SFCC_SCAPI_TENANTID"'",
    "description": "Example tenant for SLAS",
    "merchantName": "Northern Trail Outfitters",
    "contact": "Pia Larson",
    "emailAddress": "pia@northerntrailoutfitters.com"
}'
```

### Create a SLAS Client

To create a SLAS client using the SLAS Admin API, you must provide some additional configuration information, starting with a client ID.

#### Client ID

The `client_id` is a universally unique identifier (UUID) for each tenant that the SLAS service requires. There are several ways to generate a UUID, but go to [uuidgenerator.net](https://www.uuidgenerator.net/) and click **Copy** at the top of the page. The identifier must follow the UUID version 4 format: 36 characters long, including 3 hyphens.

To store the client ID in an environment variable for your API requests, replace `f58d60fd-9230-4ed7-90a4-ee11b5e7f27b` in the following command with the UUID that you generated:

```bash
export SLAS_CLIENT_ID=f58d60fd-9230-4ed7-90a4-ee11b5e7f27b
```

#### Client Secret

If you’re creating a private client, you also must create a secret (a password) for your SLAS client. We recommend using a password manager to generate and store the secret.

To store the secret in an environment variable for your API requests, replace `D*HHUrgO2%qADp2JTIUi` in the following command with your secret:

```bash
export SLAS_CLIENT_SECRET=D*HHUrgO2%qADp2JTIUi
```

**tip:** You can also create and store your client ID and secret in Account Manager. For detailed instructions, see [Add an API Client](https://help.salesforce.com/s/articleView?id=cc.b2c_account_manager_add_api_client_id.htm&type=5) in the B2C Commerce documentation.

#### JSON Data

For creating both public and private clients, you must provide JSON data in the request body that controls important settings for SLAS:

- Use the `channels` array to associate the SLAS client with one or more channels. A channel is what we call the string used to identify a particular ecommerce site.
- The `scopes` array lists all the API families that the SLAS API has access to. Note that SLAS is capable of handling a maximum of 30 Custom Object scopes. For details, see [Shopper Custom Objects API.](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-custom-objects?meta=Summary)
- The `redirectUri` array allows specific URIs for redirects. Wildcard characters (`*`) are supported for hostnames.

In the example requests provided, the request body includes common settings that you can customize for your application.

#### Example Request\: Create a Public SLAS Client

To create a public SLAS client, run this command:

```bash
curl "https://$SFCC_SCAPI_SHORTCODE.api.commercecloud.salesforce.com/shopper/auth-admin/v1/tenants/$SFCC_SCAPI_TENANTID/clients/$SLAS_CLIENT_ID" \
--request "PUT"
--header "Content-Type: application/json" \
--header "Authorization: Bearer $SFCC_ACCESS_TOKEN" \
--data-raw '{
    "clientId": "'"$SLAS_CLIENT_ID"'",
    "isPrivateClient": false,
    "name": "Test Client",
    "channels": [
        "RefArch",
        "RefArchGlobal",
        "SiteGenesis"
    ],
    "scopes": [
        "sfcc.shopper-baskets-orders.rw",
        "sfcc.shopper-categories",
        "sfcc.shopper-customers.login",
        "sfcc.shopper-customers.register",
        "sfcc.shopper-gift-certificates",
        "sfcc.shopper-myaccount.rw",
        "sfcc.shopper-product-search",
        "sfcc.shopper-productlists",
        "sfcc.shopper-products",
        "sfcc.shopper-promotions",
        "sfcc.shopper-stores"
    ],
    "redirectUri": ["http://localhost:3000/callback", "https://*.mobify-storefront.com/callback", "https://*.exp-delivery.com/callback"]
}'
```

Since the request is for setting up a public client, no client secret is required.

#### Example Request\: Create a Private SLAS Client

**warning:** Don't use the `sfcc.shopper-context.rw` scope with a PUBLIC Client because it offers fewer protections and could potentially enable malicious actors to access Shopper Context enabled promotions. It is highly recommended to use `sfcc.shopper-context.rw` scope with a private client.

To create a private SLAS client, run this command:

```bash
curl "https://$SFCC_SCAPI_SHORTCODE.api.commercecloud.salesforce.com/shopper/auth-admin/v1/tenants/$SFCC_SCAPI_TENANTID/clients/$SLAS_CLIENT_ID" \
--request 'PUT'
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer $SFCC_ACCESS_TOKEN' \
--data-raw '{
    "clientId": "'"$SLAS_CLIENT_ID"'",
    "secret": "'"$SLAS_CLIENT_SECRET"'",
    "isPrivateClient": true,
    "name": "Test Client",
    "channels": [
        "RefArch",
        "RefArchGlobal",
        "SiteGenesis"
    ],
    "scopes": [
        "sfcc.shopper-baskets-orders.rw",
        "sfcc.shopper-categories",
        "sfcc.shopper-customers.login",
        "sfcc.shopper-customers.register",
        "sfcc.shopper-gift-certificates",
        "sfcc.shopper-myaccount.rw",
        "sfcc.shopper-product-search",
        "sfcc.shopper-productlists",
        "sfcc.shopper-products",
        "sfcc.shopper-promotions",
        "sfcc.shopper-stores"
    ],
    "redirectUri": ["http://localhost:3000/callback", "http://example.com/callback"]
}'
```

## Next Steps

Now that you know how to set up SLAS clients, it’s time to make some API requests! Learn how to formulate your API requests with the last guide in the Get Started series: [Base URL and Request Formation](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/base-url.md).

To learn more about using public SLAS clients and private SLAS clients to access the Shopper APIs, see the [SLAS guides](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas.md).

For more technical details on the capabilities of the SLAS APIs, explore the API specifications in the Reference section:

- [SLAS API](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=shopper-login:Summary)
- [SLAS Admin API](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=slas-admin:Summary)

To learn how to access the SCAPI Admin APIs, see [Authorization for Admin APIs](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization-for-admin-apis.md).