---
schema_version: "1"
id: 221ec340eefe9218d1a078dbe296ba5b67246c89f68bbb4b2114d5d14a78e0c5
title: Authorization
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/authorization.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: f2fcc0a9c70f448dbbc3e9699268cb74a47231ec8e341e53f41b6866cf264e36
products:
  - Composable Storefront
  - Salesforce APIs
---
# Authorization

Authorization for the B2C Commerce API resources is handled not through user permissions, but through _client_ permissions.

A client for the B2C Commerce API can take many forms: anything from an online storefront to custom merchandising tools.

To authorize this wide range of client types, we’ve defined a set of scopes based on the OAuth 2.1 standard. The [available scopes](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/auth-z-scope-catalog.md) give you control over exactly what clients are authorized to do with the SCAPI Admin APIs and Shopper APIs.

**important:** Not all endpoints use the same security scheme for authorization. Always check the Security section of the endpoint documentation, which is hidden by default.

## Access Tokens

Both the Admin and Shopper APIs are authorized using an access token in the form of a [JSON Web Token](https://en.wikipedia.org/wiki/JSON_Web_Token) (JWT).

Using JWTs offers the following benefits:

- Coarse-grained client permissions with read-only and read-write permissions.
- Allows you to grant the same permissions for multiple B2C Commerce instances.
- Standardized, mature, and established technology.

The JWT access tokens for both SCAPI Admin APIs and Shopper APIs are included in your API requests as an HTTP header that follows the [Bearer authentication scheme](https://swagger.io/docs/specification/authentication/bearer-authentication/).

**important:** The SCAPI Admin APIs and Shopper APIs each have their own mechanisms for setting up API clients and requesting access tokens.

## Quick Path to a Token

| I need a... | Fastest path |
|-------------|-------------|
| **Shopper API token** | Create a SLAS client ([guide](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization-for-shopper-apis.md)), then call the `/token` endpoint ([SLAS overview](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas.md)). |
| **Admin API token** | Create an API client in Account Manager ([guide](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization-for-admin-apis.md)), then POST to `oauth2/access_token`. |

For a runnable example that fetches a token and calls an endpoint, see [Make Your First Request](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/scapi-get-started.md#make-your-first-request).

## Next Steps

- To set up SCAPI Admin API access, see the [Authorization for Admin APIs](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization-for-admin-apis.md) guide.
- To set up Shopper API access, see the [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/authorization-for-shopper-apis.md) guide.
- For advanced SLAS topics (grant types, token types, refresh tokens), see the [SLAS overview](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas.md).
- Review the complete [Authorization Scopes Catalog](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/auth-z-scope-catalog.md).