--- schema_version: "1" id: 12fda1bdc385e1684c023ece544fddce99f2a1f6bcdf60530e7f75486af4df62 title: Trusted Agent Authorization collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/slas-trusted-agent.md canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-trusted-agent.html source_site: developer.salesforce.com content_type: documentation content_hash: ec09f052913d04773826c24eb61bbef445b2d70e8b61b1df3b3539485d32c59d products: - Composable Storefront - Salesforce APIs --- # Trusted Agent Authorization Trusted Agent on Behalf (TAOB) authorization allows an agent to perform actions on behalf of a registered or guest shopper. **note:** By default, shopper tracking preferences are disabled for all TAOB flows, which means that `dnt` is set to `true`. This differs from other SLAS token requests, in which `dnt` is set to `false`. ## Configure Trusted Agent Authorization 1. Configure Business Manager permissions: - In Business Manager, configure the following functional permissions for one or more agents in your organization: `Login_On_Behalf` and `Create_Order_On_Behalf`. - For detailed instructions, see the [Business Manager Functional Permissions](https://help.salesforce.com/s/articleView?id=cc.b2c_administrator_role.htm&type=5) article in the B2C Commerce documentation. 2. Configure SLAS: - Create a dedicated public client ID to use in the OAuth `auth_code` PKCE flow. For details, see [Public SLAS Client Use Cases](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-public-client.html). - Add the `sfcc.ta_ext_on_behalf_of` scope to your SLAS client. - Set a redirect URI. 3. Perform the steps for registered and guest shoppers in the following sections, as applicable. 4. To initialize an Agentforce session, obtain a SLAS shopper access token that includes the `sfcc.shopper-agents.rw` scope, and then call the [Shopper Agents API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-agents?meta=Summary) with the `sessionInitKey` received at session start. ### Specify TAOB Parameters for Guest Shoppers **note:** Make sure you use the public client ID created when configuring SLAS. 1. Set `login_id` to `guest`. 2. Set `idp_origin` to `slas`. This is standard for SLAS Guest requests. If any other `idp_origin` value is used, SLAS returns a bad request. 3. If the trusted agent needs access to the existing basket of a guest shopper (viewing or updating), you must pass the same USID that was included in the shopper token. 4. You must pass the `state` parameter in the TAOB guest Token request to get the TAOB `access_token` to transfer the state from the authorization call to the token call. The `state` parameter value is returned with the authorization code in the response url from the TAOB guest authorization call, for example: `.../taob/callback?code=HETXpvg5LKBNIHjDTWkRrf2MLVU&state=taob.gst.7bc7fb7f-e646-44fd-bc73-dfd5c3c9019b` ![SLAS trusted agent authentication for guest users](https://developer.salesforce.com/docs/media/commerce-api/slas-trusted-agent-guest.png) #### Example: TAOB Authorization Request for a Guest Shopper ```bash curl 'https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organization/$ORG/oauth2/trusted-agent/authorize' \--get \--data "client_id=$CLIENT" \--data "channel_id=$SITE" \--data "redirect_uri=$REDIRECT" \--data 'response_type=code' \--data 'idp_origin=slas' \--data-urlencode "login_id=guest" \--data "code_challenge=$CHALLENGE' ``` #### Example: TAOB Token Request for a Guest Shopper In the authorization header, use the value from the `code` query parameter that was returned when the agent authenticated with Account Manager: ```bash curl 'https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organization/$ORG/oauth2/trusted-agent/token' \ --header 'Authorization: Bearer jpsM6DNwzFtrUIZJDwyRihkRX1g' \ --data "client_id=$CLIENT" \ --data "channel_id=$SITE" \ --data 'grant_type=client_credentials' \ --data 'idp_origin=slas' \ --data-urlencode 'login_id=guest' \ --data-urlencode 'agent_id=example@yourdomain.com' \ --data-urlencode 'channel_id=SiteGenesis' \ --data 'code_verifier=`$VERIFIER' \ --data 'state=taobgst.3ebdcbb6-ef87-4f41-8173-67728636e513' ``` ### Specify TAOB Parameters for Registered Shoppers **note:** Make sure you use the public client ID created when configuring SLAS. 1. Set `login_id` to the shopper's credentials. 2. Set `idp_origin` to `ecom`. Consider the following scenario where trusted agent authorization is used to help a registered shopper: 1. Lauren is a call center agent who helps shoppers with their orders. 2. Tim is a shopper who contacts the call center. He wants to update the quantity of shirts in his order but is having difficulty doing it himself. 3. Using the SLAS TAOB flow, Lauren gains access to Tim’s account, which gives her access to the items added to the cart. 4. Lauren successfully updates the quantity of shirts in Tim’s order. 5. Tim is pleased with the Lauren’s help and completes his order. **note:** This flow is specifically for Account Manager when it serves as the IDP for agents. For agents using a different IDP, consider using the [SLAS Trusted System On-behalf (TSOB)](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-trusted-system.html) call flow to provide the SLAS shopper JSON Web Token (JWT) in your custom agent solution. The following diagram shows the typical API requests and responses used in the trusted agent authorization flow for a registered shopper: ![SLAS trusted agent authentication and authorization process](https://developer.salesforce.com/docs/media/commerce-api/slas-trusted-agent.png) #### Example: TAOB Authorization Request for a Registered Shopper The following commands demonstrate how to authorize a trusted agent using a public client. **important:** When running the sample code provided, don’t forget to replace the placeholder values with actual values. Start by requesting an authorization code for a trusted agent using [getTrustedAgentAuthorizationToken](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getTrustedAgentAuthorizationToken): ```bash curl "https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organization/$ORG/oauth2/trusted-agent/authorize" \ --get \ --data "client_id=$CLIENT" \ --data "channel_id=$SITE" \ --data "redirect_uri=$REDIRECT" \ --data 'response_type=code' \ --data 'idp_origin=ecom' \ --data-urlencode "login_id=jack.shopper" \ --data-urlencode 'agent_id=example@yourdomain.com' \ --data-urlencode 'channel_id=SiteGenesis' \ --data "code_challenge=$CHALLENGE" ``` The request redirects you to Account Manager for authentication. After a successful login, you are redirected to the address provided in the `redirect_uri` parameter of the previous request. When redirecting, the authorization code is included in the `code` query parameter. Now request a trusted agent token using [getTrustedAgentAccessToken](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getTrustedAgentAccessToken). In the authorization header, use the value from the `code` query parameter that was returned when the agent authenticated with Account Manager: ```bash curl "https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organization/$ORG/oauth2/trusted-agent/token" \ --header 'Authorization: Bearer jpsM6DNwzFtrUIZJDwyRihkRX1g' \ --data "client_id=$CLIENT" \ --data "channel_id=$SITE" \ --data 'grant_type=client_credentials' \ --data 'idp_origin=ecom' \ --data-urlencode 'login_id=jack.shopper' \ --data "code_verifier=$VERIFIER" ``` **note:** Trusted agent tokens expire after 15 minutes and are not refreshable. _To get a new token, restart the authorization flow._ ## Troubleshoot - If you receive the following response code, verify the SLAS configuration and Business Manager permissions: ```json { "status_code": "403 FORBIDDEN", "message": "AM SSO Unauthorized!" } ``` - The following response code indicates that the `agent_id` and the `login_id` are the same, which is not allowed: ```json { "status_code": "403 FORBIDDEN", "message": "Agent Id - AM SSO Unauthorized!" } ```