--- schema_version: "1" id: d7c09ec696196840e0c6244b9447b3c34f92bbd102e27ab26c81c2781a871577 title: Passwordless Login with SMS Service Provider collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/slas-passwordless-sms.md canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-passwordless-sms.html source_site: developer.salesforce.com content_type: documentation content_hash: d96cf0a783176005a5795623a293a69c684141ea9993ae8a8391b8aa94a784dc products: - Composable Storefront - Salesforce APIs --- # Passwordless Login with SMS Service Provider Use SMS to send verification codes to authenticate shoppers with the [passwordless login](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login.html) feature of the Shopper Login and API Access Service (SLAS). This guide includes instructions for integrating passwordless login with SMS by using either Agentforce Marketing or Amazon Simple Notification Service (SNS). SLAS doesn't support SMS delivery of one-time passwords (OTPs). To have an OTP sent by SMS, use `mode=callback` and manage the SMS delivery from your callback. ## Before You Begin To complete the instructions in this guide, you must have: - An active B2C Commerce license. - An SMS service provider. For example, Agentforce Marketing or Amazon SNS. - Provisioned SMS short or long codes for each country where you have SMS recipients. ## Other Considerations - **Prior login:** A shopper must log in via SLAS at least one time before requesting a passwordless login. - **Registration:** The shopper’s phone number must be registered with B2C Commerce. - **Volume limits:** Sending SMS message for passwordless login counts towards your overall volume. ## Example A: Agentforce Marketing ![SLAS passwordless login flow with Agentforce Marketing for SMS integration](https://developer.salesforce.com/docs/media/commerce-api/slas-passwordless-sms-marketing-cloud.png '{"class": "image-xl"}') This diagram illustrates the complete lifecycle of a passwordless login request. It begins when the storefront app calls SLAS with `mode=callback`. SLAS then delegates the OTP delivery to your backend server. Finally, your server authenticates with Agentforce Marketing to dispatch the SMS before returning a success response to SLAS. ### Agentforce Marketing Prerequisites - An active Agentforce Marketing license with an SMS subscription. - Admin access for your Agentforce Marketing instance with permission to install apps. - An SMS country code and short code for your Agentforce Marketing instance. 👉 To provision an SMS short code, contact your Agentforce Marketing account representative. ### Agentforce Marketing Configuration #### 1. Set Up Agentforce Marketing Server-to-Server Integration Set up a server-to-server integration in Agentforce Marketing. This allows your backend to make API calls to Agentforce Marketing to send SMS messages. See [Server-to-Server Integrations with Client Credentials Grant Type](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-s2s-client-credentials.html) in _Agentforce Marketing Engagement APIs and Programmatic Languages._ #### 2. Set Up a Transactional SMS Send Definition Create a send definition that contains the message template and delivery configuration. a. Use your Cilent ID and secret to request an access token for Agentforce Marketing. See [Access Token for Server-to-Server Integrations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) in _Agentforce Marketing Engagement APIs and Programmatic Languages._ For example: ```sh curl "https://$MARKETING_CLOUD_SUBDOMAIN.auth.marketingcloudapis.com/v2/token" \ --request POST \ --header "Content-Type: application/json" `\` --data '{ "grant_type": "client_credentials", "client_id": "2bfe9d72a4aae8f06a31025b7536be80", "client_secret": "9d667c2b7fae7a329f32b6df17926154", "scope": "sms_read sms_write sms_send" }' ``` b. Create the SMS definition using the access token received in step 2a. See [POST /messaging/v1/sms/definitions](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_transactional_messaging_sms/createSMSSendDefinition.html) in _Agentforce Marketing Engagement APIs and Programmatic Languages._ ```sh curl "https://$MARKETING_CLOUD_SUBDOMAIN.rest.marketingcloudapis.com/messaging/v1/sms/definitions/" \ --request POST \ --header "Content-Type: application/json" \ --header "Authorization: Bearer $ACCESS_TOKEN" \ --data '{ "definitionKey": "pwdless_login", "name": "pwdless_login", "content": { "message": "Your login code is: %%token%%" }, "subscriptions": { "shortCode": "8201221", "countryCode": "US", "keyword": "PASSWORDLESS_LOGIN" } }' ``` #### 3. Create a Backend Server to Host the Callback URI This sample code shows how to configure a backend server for Agentforce Marketing integration. The code handles the HTTP POST request from SLAS and uses Marketing Cloud to send the SMS with the OTP to the user. **note:** This sample code is provided for guidance and isn't production-ready. Make sure that your code is properly tested before deployment. ```text import { randomUUID } from 'node:crypto' const MC_SUBDOMAIN = // MARKETING_CLOUD_SUBDOMAIN const MC_CLIENT_ID = // MARKETING_CLOUD_CLIENT_ID const MC_CLIENT_SECRET = // MARKETING_CLOUD_ORG_CLIENT_SECRET export const handler = async (event) => { try { const body = JSON.parse(event.body || '{}') console.log('Received event:', body) const { phone, token, login_id } = body // Step 1: Get access token const tokenRes = await fetch(`https://${MC_SUBDOMAIN}.auth.marketingcloudapis.com/v2/token`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ grant_type: 'client_credentials', client_id: MC_CLIENT_ID, client_secret: MC_CLIENT_SECRET, scope: 'sms_read sms_write sms_send' }) }) const { access_token } = await tokenRes.json() // Step 2: Send SMS const messageKey = randomUUID() const smsRes = await fetch(`https://${MC_SUBDOMAIN}.rest.marketingcloudapis.com/messaging/v1/sms/messages/${messageKey}`, { method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${access_token}` }, body: JSON.stringify({ definitionKey: 'pwdless_login_us', recipient: { to: phone, contactKey: login_id, attributes: { token } } }) }) const smsText = await smsRes.text().catch(() => '') return { statusCode: 200, body: JSON.stringify({ message: 'SMS request submitted', messageKey, marketingCloudResponse: JSON.parse(smsText)}) } } catch (err) { console.error('Error:', err) return { statusCode: 500, body: JSON.stringify({ error: err?.message || 'Unknown error' }) } } } ``` #### 4. Add the Callback URL to Your SLAS Private Client After creating the backend server, add the URI to the Callback URL list for your SLAS Private Client. See [Configure a SLAS Private Client](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login.html#configure-a-slas-private-client). Next, continue to [Authorize with SMS](#authorize-with-sms). ## Example B: Amazon SNS ![SLAS passwordless login flow with Amazon SNS for SMS integration](https://developer.salesforce.com/docs/media/commerce-api/slas-passwordless-login-sms-amazon.png '{"class": "image-xl"}') This diagram shows the delivery flow using Amazon SNS. The process starts when the storefront app requests a login. SLAS forwards the token to your backend server, which uses the AWS SDK to publish the message directly to the shopper. Because the SDK handles authentication via configuration, no separate token request is required. #### Amazon SNS Prerequisites To integrate passwordless login with Amazon SNS, you must have: - Amazon SNS with production access. - Provisioned SMS short or long codes in Amazon SNS for each country where you have SMS recipients. #### 1. Create a Backend Server to Host the Callback URI This sample code shows how to configure a backend server for Amazon SNS integration. The code handles the HTTP POST request from SLAS and uses Amazon SNS to send the SMS with the one-time password to the user. **note:** This sample code is provided for guidance and isn't production-ready. Make sure that your code is properly tested before deployment. ```text import { SNSClient, PublishCommand } from '@aws-sdk/client-sns' const snsClient = new SNSClient({ region: 'us-east-1' }) export const handler = async (event) => { try { const body = JSON.parse(event.body || '{}') const { phone, token } = body await snsClient.send(new PublishCommand({ Message: `Your login code is: ${token}`, PhoneNumber: phone // Must be E.164 format })) return { statusCode: 200, body: JSON.stringify({ message: 'SMS sent successfully' }) } } catch (err) { console.error('Error sending SMS:', err) return { statusCode: 500, body: JSON.stringify({ error: 'Failed to send SMS' }) } } } ``` #### 2. Add the Callback URL to Your SLAS Private Client After creating the backend server, add the URI to the Callback URL list for your SLAS Private Client. See [Configure a SLAS Private Client](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login.html#configure-a-slas-private-client). Next, continue to [Authorize with SMS](#authorize-with-sms). ## Authorize with SMS ### 1. Set Environment Variables To form requests to the SLAS APIs correctly, it helps to set some environment variables first: | Variable | Example Value | Description | | ----------------------- | ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `$SFCC_SCAPI_SHORTCODE` | `kv7kzm78` | [Short code](https://developer.salesforce.com/docs/commerce/commerce-api/guide/commerce-api-configuration-values.html) for your B2C Commerce instance, not the short code that is provisioned for Agentforce Marketing SMS | | `$ORGANIZATION_ID` | `abcd_s01` | [Organization ID](https://developer.salesforce.com/docs/commerce/commerce-api/guide/commerce-api-configuration-values.html) for your B2C Commerce instance | | `$CHANNEL_ID` | `SiteGenesis` | Site name (also known as channel name) in Business Manager | | `$CALLBACK_URI` | `https://webhook.site/9f44093b-d129-42be-84d3-2f17254df04b` | URI for redirection after authorization | | `$CLIENT_ID` | `872daaa2-412e-40c8-a48a-5a56daaef868` | The SLAS client ID | | `$USER_ID` | `pia.larson` | The user ID for logging in the shopper | | `$ACCESS_TOKEN` | (not provided for security reasons) | Access token from SLAS | **note:** If you’re not using a Unix-based operating system, manually replace the variables later in the `curl` command provided. ### 2. Request Authorization This sample request uses the environment variables set earlier and the [authorizePasswordlessCustomer](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizePasswordlessCustomer) endpoint of the SLAS API (not the same as the SLAS Admin API) to authorize a customer via SMS: ```sh curl "https://$SFCC_SCAPI_SHORTCODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORGANIZATION_ID/oauth2/passwordless/login" \ --request 'POST' \ --header "Authorization: Basic $ACCESS_TOKEN" --data "channel_id=$CHANNEL_ID" \ --data 'mode=callback' \ --data "callback_uri=$CALLBACK_URI \ --data "client_id=$CLIENT_ID \ --data "user_id=$USER_ID \ --data 'locale=en-us' ``` For more details on making API requests for shopper authorization, see the [Passwordless Login](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login.html) guide and the [SLAS API reference](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizePasswordlessCustomer).