---
schema_version: "1"
id: ddbe554dc3e93eff1321348a0130f895fe8babcf725a029a5a8c2ead6d123781
title: SLAS Trusted System on Behalf Authorization
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/slas-trusted-system.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-trusted-system.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 3c0df2f8fdfe100a128f2a9e39d289de91910d4c00ac50de3ae147c5c2dd7bed
products:
  - Composable Storefront
  - Salesforce APIs
---
# SLAS Trusted System on Behalf Authorization

Trusted System on Behalf (TSOB) is a login flow designed for system to system communication in back office workflows, for example:

- You want all logins to route through your external IDP and don’t want customers to login with SLAS.
- You want to take action as a system on behalf of a shopper.

TSOB authentication uses the [`getTrustedSystemAccessToken`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getTrustedSystemAccessToken) endpoint, which requires a SLAS [private](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#slas-clients) client with the `sfcc.ts_ext_on_behalf_of` scope. For details, see the [Authorization Scopes Catalog](https://developer.salesforce.com/docs/commerce/commerce-api/guide/auth-z-scope-catalog.html).

**note:** TSOB is not the preferred method for Shopper authentication flows as it is outside the OAuth and OIDC standard. For the most secure authentication mechanism, use one of the workflows described in [Shopper Login](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html) public and private use cases. Do not use TSOB if shopper information frequently changes and `idp_origin=ecom`, as TSOB will not retrieve the most up-to-date customer information from B2C Commerce.

**important:** SLAS Trusted System on Behalf (TSOB) login has a service window of 3 seconds.

## Shopper login_ids and USIDs

Each shopper is associated with a unique `login_id`. You must use the shopper's unique `login_id` for each interaction with that shopper. Otherwise, multiple shopper records are created in SLAS and B2C Commerce. If a new `login_id` is passed in for TSOB using an IDP, a new shopper is created.

Each USID is a unique shopper ID that is created for a specific shopper's session. After a USID is created, you can use it across that shopper's interactions. The SLAS client API application (SPA, Mobile, Composable, etc.) handles the USID, which must be saved by the client API app and used as needed when making SLAS API calls.

To avoid issues with claim size during token creation, we recommend limiting the `login_id` or `email_id` to 60 characters or fewer.

## Shopper Verification

TSOB using an IDP, for example: Google, does **not** make a call to the IDP for user verification, because SLAS performs checks to verify a user is valid. Using the SLAS /authorize endpoint provides the strongest validation from the IDP.

## SLAS TSOB Shopper Flows

All TSOB flows require a SLAS private client id and secret to be in an Authorization header.

### Guest Shopper Flow

To request a guest shopper TSOB token:

```sh
curl "$https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORG/oauth2/trusted-system/token" \
  -u "$CLIENT:$SECRET" \
  -d 'hint=ts_ext_on_behalf_of' \
  -d 'grant_type=client_credentials' \
  -d "channel_id=$SITE" \
  -d 'idp_origin=ecom' \
  -d 'login_id=guest'
```

Provide body parameters `idp_origin=ecom` and `login_id=guest`.

### Registered B2C Commerce Shopper Flow

To request a registered shopper TSOB token:

```sh
curl "$https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORG/oauth2/trusted-system/token" \
    -u "$CLIENT:$SECRET" \
    -d 'hint=ts_ext_on_behalf_of' \
    -d 'grant_type=client_credentials' \
    -d "channel_id=$SITE" \
    -d 'idp_origin=ecom' \
    --data-urlencode 'login_id=shopper@salesforce.com'
```

Provide body parameters `idp_origin=ecom` and `login_id`, whose value is the login of an existing registered shopper.

If the shopper does not exist, SLAS returns an HTTP 400:

```json
{
  "status_code": "400 BAD_REQUEST",
  "message": "External user not found"
}
```

### Registered Shopper with External IDP Flow

To request a TSOB token for a shopper registered through an external IDP:

```sh
curl "$https://$CODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORG/oauth2/trusted-system/token" \
    -u "$CLIENT:$SECRET" \
    -d 'hint=ts_ext_on_behalf_of' \
    -d 'grant_type=client_credentials' \
    -d "channel_id=$SITE" \
    -d 'idp_origin=$IDP' \
    -d "login_id=$SHOPPER"
```

Provide body parameters `idp_origin`, whose value is the ID of the IDP and `login_id`, whose value is the shopper login.

If the shopper record does not exist, SLAS creates it. The shopper's `login_id`, `first_name`, and `last_name` as set to the value provided. _SLAS does not communicate with the IDP to get the shopper information._

## TSOB Token Response

TSOB returns a [TokenResponse](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=type%3ATokenResponse), including a SLAS TSOB access token for the shopper and a refresh token. A TSOB access token includes the `tsob:ts_ext_on_behalf_of` type in the `isb` sub-claim.

The refresh token can be used with the [`getAccessToken`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getAccessToken) endpoint to obtain a new TSOB access token. When an access_token is refreshed, the new token's TTL is reset. The refresh token's TTL is also reset.

## Customer Profile Last-Login Update

After a successful TSOB login, SLAS updates the last-login timestamp on the shopper's B2C Commerce customer profile and increments the version of the customer profile object. This behavior applies starting with the 26.6 B2C Commerce release.

## Constraints

To protect against overuse, if multiple calls for the same shopper are made in succession, SLAS returns an HTTP 409:

```json
{
  "status_code": "409 CONFLICT",
  "message": "Tenant id <tenant_Id> has already performed a login operation for user id <user_id> on OCAPI in the last 3 seconds."
}
```