Shopper Login (SLAS)

POST Log in a shopper with credentials that are managed by a B2C Commerce instance (B2C Commerce).

POST /organizations/{organizationId}/oauth2/login

Operation ID: authenticateCustomer.

This follows the authorization code grant flow as defined by the OAuth 2.1 standard. It also uses a proof key for code exchange (PKCE).

For PKCE values:

• The code_verifier string is a random string used for the /token endpoint request.
• The code_challenge is an encoded version of the code_verifier string using an SHA-256 hash.

The request must include a basic authorization header that contains a Base64 encoded version of the following string: <shopperUserID>:<shopperPassword>. Required parameters: code_challenge, channel_id, client_id, and redirect_uri.

Optional parameters: usid. The SLAS /login endpoint redirects back to the redirect URI and returns an authorization code. Calls to /login made with the same loginId and tenantId within 1 second result in a conflict.

Parameters

• organizationId (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character realm identifier and a 3-character instance type identifier.
  Minimum length: 1. Maximum length: 32. Example: f_ecom_zzxy_prd.

  Example

  f_ecom_zzxy_prd

• Authorization (header, string, required) Base64-encoded username and password for HTTP basic authentication
  Example: Basic <client credentials>.
• x-slas-client-auth (header, string)

  Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (:). For example, clientId:clientSecret. Don't add the string "Basic".

  The x-slas-client-auth header is supported for SLAS private clients. When strict client auth is enabled for the client, requests without this header are rejected with a 401.

Request body (required)

Media type: application/x-www-form-urlencoded. Schema: LoginRequest.

Responses

• 303 The authorization code and usid were successfuly added to the location header and sent to the callback as query parameters.

  Headers:

  • X-RateLimit-1M-Limit (string) The 1 minute maximum number of requests permitted per hour.
  • X-RateLimit-1M-Remaining (string) The 1 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-1M-Reset (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds.
  • X-RateLimit-5M-Limit (string) The 5 minute maximum number of requests permitted per hour.
  • X-RateLimit-5M-Remaining (string) The 5 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-5M-Reset (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds.

  Media type: application/json. Schema: string.

  Type: string.

  Example: authenticateCustomerSuccess

  {
    "location": "https://<host>:<port>/callback?usid=d11392ae-cbf0-4296-9723-8f9f0e49fd73&state=1728422547223&scope=openid%20offline_access&code=561X8NOKvoRezq2aucazwwkrevUoIP37YRTfsRHX8ow"
  }

• 400 Bad request

  Headers:

  • X-RateLimit-1M-Limit (string) The 1 minute maximum number of requests permitted per hour.
  • X-RateLimit-1M-Remaining (string) The 1 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-1M-Reset (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds.
  • X-RateLimit-5M-Limit (string) The 5 minute maximum number of requests permitted per hour.
  • X-RateLimit-5M-Remaining (string) The 5 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-5M-Reset (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds.

  Media type: application/problem+json. Schema: Oauth2ErrorResponse.

  Example: BadOrMissingClientId400

  {
    "error": "invalid_request",
    "error_description": "Bad or missing client_id."
  }

• 401 Unauthorized

  Headers:

  • X-RateLimit-1M-Limit (string) The 1 minute maximum number of requests permitted per hour.
  • X-RateLimit-1M-Remaining (string) The 1 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-1M-Reset (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds.
  • X-RateLimit-5M-Limit (string) The 5 minute maximum number of requests permitted per hour.
  • X-RateLimit-5M-Remaining (string) The 5 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-5M-Reset (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds.

  Media type: application/problem+json. Schema: Oauth2ErrorResponse.

  Example: InvalidBasicAuth401

  {
    "error": "invalid_client",
    "error_description": "Basic Authorization failed."
  }

• 409 Conflict

  Media type: application/problem+json. Schema: Oauth2ErrorResponse.

  Example: ConflictingCalls409

  {
    "error": "conflict",
    "error_description": "The same loginId and tenantId tried to login twice within 1 second."
  }

• 500 Internal server error

  Headers:

  • X-RateLimit-1M-Limit (string) The 1 minute maximum number of requests permitted per hour.
  • X-RateLimit-1M-Remaining (string) The 1 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-1M-Reset (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds.
  • X-RateLimit-5M-Limit (string) The 5 minute maximum number of requests permitted per hour.
  • X-RateLimit-5M-Remaining (string) The 5 minute number of requests remaining in the current rate limit window.
  • X-RateLimit-5M-Reset (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds.

  Media type: application/problem+json. Schema: Oauth2ErrorResponse.

  Example: InternalServerError500

  {
    "error": "server_error",
    "error_description": "The server has encountered a situation that it doesn't know how to handle."
  }