---
schema_version: "1"
id: a8102f248b70790e03023e4111182bb2118ec0784492fef1f20d1ff2126497f0
title: Passwordless Login with One-Time Passwords using Callback URI
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/slas-passwordless-login.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-passwordless-login.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 0bfc8548c717436997e232fed6e0b17605f2b6d500860215dfde6e1a250287ae
products:
  - Composable Storefront
  - Salesforce APIs
---
# Passwordless Login with One-Time Passwords using Callback URI

Use the Shopper Login and API Access Service (SLAS) to send 8-digit, time-based one-time passwords (OTPs) to your shoppers for authentication. For an overview of other passwordless login methods, see [Passwordless Login](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login-overview).

**tip:** Only existing customers can access some of the links on this page. Visit [Salesforce Commerce Cloud GitHub Repositories and Access](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-github-repo-access.html) for information about how to get access to the repositories.


SLAS passwordless login tokens expire after 10 minutes.

## Overview

To understand how passwordless login with SLAS works, let’s look at an overview of the process.

**note:** The shopper must have an existing B2C Commerce or third-party IDP account, and must log in with a username and password prior to using passwordless login. Otherwise, you can call the [`authorizePasswordlessCustomer`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizePasswordlessCustomer) endpoint with the `register_customer` query parameter set to `true`. See [Register a Customer with Passwordless Login](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login-registration.html).

![SLAS passwordless login authentication process and token exchange](https://developer.salesforce.com/docs/media/commerce-api/slas-passwordless-login-flow.png)

1. The shopper opens the app and logs in.
2. The shopper requests a passwordless login.
3. Your app calls the [authorizePasswordlessCustomer](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizePasswordlessCustomer) endpoint and provides a callback URI.
4. SLAS makes an HTTP POST request to your callback URI, including the shopper's contact information and an eight-digit time-based one-time password (TOTP) that can be used to authenticate the shopper.
5. The app sends TOTP to the shopper over email, SMS or another mechanism.
6. The shopper provides the TOTP to the app either by clicking a link or entering the it manually.
7. Your app calls the [getPasswordLessAccessToken](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getPasswordLessAccessToken) endpoint to authenticate the shopper and get a SLAS access and refresh token.

**note:** After a successful passwordless login (including TOTP validation), SLAS updates the last-login timestamp on the shopper's B2C Commerce customer profile and increments the version of the customer profile object. This behavior applies starting with the 26.6 B2C Commerce release.

8. The access token can be used to make authorized requests on behalf of the shopper.

## Prerequisites

1. A publicly accessible callback URL, such as an B2C Commerce instance, Managed Runtime environment, or your own server. If you don't have a public callback URL, use a service like [Webhook.site](https://webhook.site/) for testing purposes.
2. A mechanism to share the passwordless token to the shopper, such as email or SMS.
3. A SLAS private client configured to work with passwordless login.

:::import
Include a secret value, such as an unguessable query string parameter, in your callback URL to validate that requests are from the SLAS web service.
:::

### Configure a SLAS Private Client

If you haven’t already created a SLAS private client, follow the instructions in [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-shopper-apis.html#create-a-slas-client) to create one and return to this guide. Only private clients can be used for passwordless login.

To configure a private client for passwordless login, follow these steps in the SLAS Admin UI:

1. From the top navigation, click **Clients**.
2. Click the **Edit** link next to the client ID that you created earlier.
3. In the Scopes field, add `sfcc.pwdless_login`.
4. In the Callback URL field, enter the callback URI that you prepared earlier.

**note:** Unlike the Redirect URL field, the Callback URL field doesn’t support wildcards. Always include the full URL for a callback, including the protocol.

5. To use 6-digit TOTPs for passwordless login, password reset, and WebAuthn authorization, select **Six Digit TOTP?**. If unselected, the default TOTP length is 8 digits. This setting can only be configured for an existing client.

![Edit client screen with Six Digit TOTP setting selected](https://developer.salesforce.com/docs/media/commerce-api/slas-six-digit-totp.png)

6. Save your changes.

## Passwordless Login Implementation

Imagine you’re building passwordless login flow for a storefront hosted at `www.example.com`. The shopper begins the flow by entering their username and requesting a passwordless login over email.

### Authorize the Customer

Request the [authorizePasswordlessCustomer](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizePasswordlessCustomer) endpoint:

```bash
#!/bin/bash
set -euo pipefail

# Update these values with your configuration:
CODE='qw1ert23'
ORG='f_ecom_abcd_001'
CLIENT='my-slas-private-client-id'
SECRET='my-slas-private-client-secret'
SITE='my-ecom-site'
CALLBACK='https://www.example.com/my-callback-url?secret=open-sesame'
LOGIN='testuser@salesforce.com'

BASE="https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORG"
curl "$BASE/oauth2/passwordless/login" \
    --user "$CLIENT:$SECRET" \
    --data "channel_id=$SITE" \
    --data 'mode=callback' \
    --data "callback_uri=$CALLBACK" \
    --data-urlencode "user_id=$LOGIN"
```

The `user_id` parameter must be the shopper’s actual login credential, `profile.credentials.login`. Although the login credential can be an email address, it is not guaranteed to be the same as `profile.email`.

### Receive the Callback

SLAS makes a HTTP POST request to the provided callback URI. The request body is a JSON payload:

```json
{
  "email_id": "shopper@salesforce.com",
  "login_id": "shopper@salesforce.com",
  "phone": "4155550123",
  "customer_id": "acCpPMFESaiAKjETZajoQbO3TS",
  "token": "12345678",
  "locale": "en-us"
}
```

It contains both an email address and a phone number that belongs to the customer. The value of `phone` is set to the value of `phoneMobile` in the B2C Commerce system. If `phoneMobile` is not available, SLAS uses the value of `phoneHome` or `phoneBusiness` instead.

The value of `token` is the TOTP to send to the shopper.

**important:** - Your callback must validate that the secret value is present in the requested URL.
- SLAS makes the POST call to the given `callback_uri` without adding additional headers or parameters. If the `callback_uri` needs additional headers, such as an authorization header, you must have a “proxy” in place between SLAS and the `callback_uri` that can add any additional headers or parameters as needed.

If you don't receive the callback from SLAS:

- Verify that your callback URL is publicly accessible. You must use a publically accessible URL because SLAS can't reach localhost or private IP addresses.
- Verify that your firewall allows requests from SLAS. Requests from `*.demandware.net` URLs are blocked.
- If your callback URL is a B2C Commerce instance with site status set to `Online (Protected)`, verify that you have disabled the protection to get the callback.

### Validate the Callback Payload

Refer to the steps in [Verify the SLAS Password Action Callback](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#verify-the-slas-password-action-callback).

### Send the TOTP to the Shopper

Your app should send the TOTP to the shopper over email or SMS.

**note:** The token is good for up to ten minutes. _If the token expires, you must restart the passwordless login flow._

### Exchange the TOTP for an Access Token

The shopper must provide the TOTP to your app, either by following a link or manually entering it.

Request the [getPasswordLessAccessToken](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getPasswordLessAccessToken) endpoint to exchange the TOTP for an access token:

```bash
#!/bin/bash
set -euo pipefail

# Update these values with your configuration:
CODE='qw1ert23'
ORG='f_ecom_abcd_001'
CLIENT='my-slas-private-client-id'
SECRET='my-slas-private-client-secret'
TOKEN='12345678'

BASE="https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORG"
curl "$BASE/oauth2/passwordless/token" \
    --user "$CLIENT:$SECRET" \
    --data 'grant_type=client_credentials' \
    --data 'hint=pwdless_login' \
    --data "pwdless_login_token=$TOKEN"
```

The optional `login_id` and `channel_id` parameters are used for stronger validation using `login_id` + `channel_id` + `pwdless_login_token` (TOTP).

The access token (Shopper JWT) returned by SLAS can now be used to make calls to the Shopper APIs!