Passwordless Login with SMS Service Provider

Use SMS to send verification codes to authenticate shoppers with the passwordless login feature of the Shopper Login and API Access Service (SLAS).

This guide includes instructions for integrating passwordless login with SMS by using either Agentforce Marketing or Amazon Simple Notification Service (SNS). SLAS doesn't support SMS delivery of one-time passwords (OTPs). To have an OTP sent by SMS, use mode=callback and manage the SMS delivery from your callback.

Before You Begin

To complete the instructions in this guide, you must have:

• An active B2C Commerce license.
• An SMS service provider. For example, Agentforce Marketing or Amazon SNS.
• Provisioned SMS short or long codes for each country where you have SMS recipients.

Other Considerations

• Prior login: A shopper must log in via SLAS at least one time before requesting a passwordless login.
• Registration: The shopper’s phone number must be registered with B2C Commerce.
• Volume limits: Sending SMS message for passwordless login counts towards your overall volume.

Example A: Agentforce Marketing

This diagram illustrates the complete lifecycle of a passwordless login request. It begins when the storefront app calls SLAS with mode=callback. SLAS then delegates the OTP delivery to your backend server. Finally, your server authenticates with Agentforce Marketing to dispatch the SMS before returning a success response to SLAS.

Agentforce Marketing Prerequisites

• An active Agentforce Marketing license with an SMS subscription.
• Admin access for your Agentforce Marketing instance with permission to install apps.
• An SMS country code and short code for your Agentforce Marketing instance.

👉 To provision an SMS short code, contact your Agentforce Marketing account representative.

Agentforce Marketing Configuration

1. Set Up Agentforce Marketing Server-to-Server Integration

Set up a server-to-server integration in Agentforce Marketing. This allows your backend to make API calls to Agentforce Marketing to send SMS messages. See Server-to-Server Integrations with Client Credentials Grant Type in Agentforce Marketing Engagement APIs and Programmatic Languages.

2. Set Up a Transactional SMS Send Definition

Create a send definition that contains the message template and delivery configuration.

a. Use your Cilent ID and secret to request an access token for Agentforce Marketing. See Access Token for Server-to-Server Integrations in Agentforce Marketing Engagement APIs and Programmatic Languages. For example:

curl "https://$MARKETING_CLOUD_SUBDOMAIN.auth.marketingcloudapis.com/v2/token" \
--request POST \
--header "Content-Type: application/json" `\`
--data '{
    "grant_type": "client_credentials",
    "client_id": "2bfe9d72a4aae8f06a31025b7536be80",
    "client_secret": "9d667c2b7fae7a329f32b6df17926154",
    "scope": "sms_read sms_write sms_send"
}'

b. Create the SMS definition using the access token received in step 2a. See POST /messaging/v1/sms/definitions in Agentforce Marketing Engagement APIs and Programmatic Languages.

curl "https://$MARKETING_CLOUD_SUBDOMAIN.rest.marketingcloudapis.com/messaging/v1/sms/definitions/" \
--request POST \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $ACCESS_TOKEN" \
--data '{
  "definitionKey": "pwdless_login",
  "name": "pwdless_login",
  "content": {
    "message": "Your login code is: %%token%%"
  },
  "subscriptions": {
    "shortCode": "8201221",
    "countryCode": "US",
    "keyword": "PASSWORDLESS_LOGIN"
  }
}'

3. Create a Backend Server to Host the Callback URI

This sample code shows how to configure a backend server for Agentforce Marketing integration. The code handles the HTTP POST request from SLAS and uses Marketing Cloud to send the SMS with the OTP to the user.

note: This sample code is provided for guidance and isn't production-ready. Make sure that your code is properly tested before deployment.

import { randomUUID } from 'node:crypto'

const MC_SUBDOMAIN = // MARKETING_CLOUD_SUBDOMAIN
const MC_CLIENT_ID = // MARKETING_CLOUD_CLIENT_ID
const MC_CLIENT_SECRET = // MARKETING_CLOUD_ORG_CLIENT_SECRET

export const handler = async (event) => {
  try {
    const body = JSON.parse(event.body || '{}')
    console.log('Received event:', body)
    const { phone, token, login_id } = body

    // Step 1: Get access token
    const tokenRes = await fetch(`https://${MC_SUBDOMAIN}.auth.marketingcloudapis.com/v2/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        grant_type: 'client_credentials',
        client_id: MC_CLIENT_ID,
        client_secret: MC_CLIENT_SECRET,
        scope: 'sms_read sms_write sms_send'
      })
    })

    const { access_token } = await tokenRes.json()

    // Step 2: Send SMS
    const messageKey = randomUUID()
    const smsRes = await fetch(`https://${MC_SUBDOMAIN}.rest.marketingcloudapis.com/messaging/v1/sms/messages/${messageKey}`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        Authorization: `Bearer ${access_token}`
      },
      body: JSON.stringify({
        definitionKey: 'pwdless_login_us',
        recipient: {
          to: phone,
          contactKey: login_id,
          attributes: { token }
        }
      })
    })

    const smsText = await smsRes.text().catch(() => '')

    return {
      statusCode: 200,
      body: JSON.stringify({ message: 'SMS request submitted', messageKey, marketingCloudResponse: JSON.parse(smsText)})
    }
  } catch (err) {
    console.error('Error:', err)
    return { statusCode: 500, body: JSON.stringify({ error: err?.message || 'Unknown error' }) }
  }
}

4. Add the Callback URL to Your SLAS Private Client

After creating the backend server, add the URI to the Callback URL list for your SLAS Private Client. See Configure a SLAS Private Client.

Next, continue to Authorize with SMS.

Example B: Amazon SNS

This diagram shows the delivery flow using Amazon SNS. The process starts when the storefront app requests a login. SLAS forwards the token to your backend server, which uses the AWS SDK to publish the message directly to the shopper. Because the SDK handles authentication via configuration, no separate token request is required.

Amazon SNS Prerequisites

To integrate passwordless login with Amazon SNS, you must have:

• Amazon SNS with production access.
• Provisioned SMS short or long codes in Amazon SNS for each country where you have SMS recipients.

1. Create a Backend Server to Host the Callback URI

This sample code shows how to configure a backend server for Amazon SNS integration. The code handles the HTTP POST request from SLAS and uses Amazon SNS to send the SMS with the one-time password to the user.

note: This sample code is provided for guidance and isn't production-ready. Make sure that your code is properly tested before deployment.

import { SNSClient, PublishCommand } from '@aws-sdk/client-sns'

const snsClient = new SNSClient({ region: 'us-east-1' })

export const handler = async (event) => {
  try {
    const body = JSON.parse(event.body || '{}')
    const { phone, token } = body

    await snsClient.send(new PublishCommand({
      Message: `Your login code is: ${token}`,
      PhoneNumber: phone // Must be E.164 format
    }))

    return {
      statusCode: 200,
      body: JSON.stringify({ message: 'SMS sent successfully' })
    }
  } catch (err) {
    console.error('Error sending SMS:', err)
    return {
      statusCode: 500,
      body: JSON.stringify({ error: 'Failed to send SMS' })
    }
  }
}

2. Add the Callback URL to Your SLAS Private Client

After creating the backend server, add the URI to the Callback URL list for your SLAS Private Client. See Configure a SLAS Private Client.

Next, continue to Authorize with SMS.

Authorize with SMS

1. Set Environment Variables

To form requests to the SLAS APIs correctly, it helps to set some environment variables first:

note: If you’re not using a Unix-based operating system, manually replace the variables later in the curl command provided.

2. Request Authorization

This sample request uses the environment variables set earlier and the authorizePasswordlessCustomer endpoint of the SLAS API (not the same as the SLAS Admin API) to authorize a customer via SMS:

curl "https://$SFCC_SCAPI_SHORTCODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORGANIZATION_ID/oauth2/passwordless/login" \
--request 'POST' \
--header "Authorization: Basic $ACCESS_TOKEN"
--data "channel_id=$CHANNEL_ID" \
--data 'mode=callback' \
--data "callback_uri=$CALLBACK_URI \
--data "client_id=$CLIENT_ID \
--data "user_id=$USER_ID \
--data 'locale=en-us'

For more details on making API requests for shopper authorization, see the Passwordless Login guide and the SLAS API reference.