--- schema_version: "1" id: 512a40c1a883ca4a86726a35a866b40e040bc17b6b168dfda2e365fe2d33c0c0 title: Login collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/marketplace/references/generated-api-specs/marketplace-seller-login.md canonical_url: https://developer.salesforce.com/docs/commerce/marketplace/references/marketplace-seller-login source_site: developer.salesforce.com content_type: documentation content_hash: afcba0503f74495843dd7cfa04d52c3332b7c17e2657553d3ea32df635a8e411 products: - Commerce Marketplace - Salesforce APIs --- Login # Login In this section, you will see the actions necessary for API authentication. The form of authentication to be used **will depend on the Salesforce licenses provided to the Sellers** who wish to integrate via API. Most Marketplaces choose **Community licenses**, with more limited access to the resources of the Salesforce org, more directed towards the use of the Atonit Marketplace. In other cases, **licenses of the Platform** type may be provided to Sellers, which will enable other resources not included in the previous license. While authentication for **users of the Platform may be performed totally through programming** - without the need for manual input - the authentication of **Community users has an initial step that requires human intervention**. In this case, if you fall under this usage profile, an application may be developed that allows this manual authentication or the same Collection as the Postman may also be used to achieve first access and record your **access tokens** and **refresh tokens**. **Version:** 1.0.0 ## Servers * `https://login.salesforce.com` * `http://mydomainname.my.site.com` * `http://{{community-url}}` * `http://{{base-url}}` ## Security * `oauth2Auth` (http) * HTTP scheme: oauth2 * `bearerAuth` (http) * HTTP scheme: bearer ## Operations ### POST Login (for Platform Users) `POST /services/oauth2/token` Operation ID: `Login (for Platform Users)`. Tags: Login. For **Platform users**, only an authentication call is required to retrieve the access token, which will be used for the other calls. The Token returned in **access\_token** must be saved and sent as a "Bearer Token" for all other calls, and must be refreshed when indicated with return of 401 for a call. **Note:** If you are connected to a sandbox environment, it is necessary to change the URL prefix from `login.salesforce...` to `test.salesforce...` #### Request body Media type: `application/x-www-form-urlencoded`. Schema: `object`. * `grant_type` (_string_) Example: `password`. * `client_id` (_string_) Example: `{{client-id}}`. * `client_secret` (_string_) Example: `{{client-secret}}`. * `username` (_string_) Example: `{{username}}`. * `password` (_string_) Example: `{{password}}`. #### Responses * **200** OK Headers: * `Date` (string) Example: `Fri, 23 Apr 2021 15:55:00 GMT`. * `Strict-Transport-Security` (string) Example: `max-age=31536000; includeSubDomains`. * `X-Content-Type-Options` (string) Example: `nosniff`. * `X-XSS-Protection` (string) Example: `1; mode=block`. * `Cache-Control` (string) Example: `no-cache,must-revalidate,max-age=0,no-store,private`. * `Expires` (string) Example: `Thu, 01 Jan 1970 00:00:00 GMT`. * `X-ReadOnlyMode` (boolean) Example: `false`. * `Content-Type` (string) Example: `application/json;charset=UTF-8`. * `Vary` (string) Example: `Accept-Encoding`. * `Content-Encoding` (string) Example: `gzip`. * `Transfer-Encoding` (string) Example: `chunked`. Media type: `application/json`. Schema: `object`. _Example_ ``` { "access_token": "[example]", "instance_url": "https://{MyDomainName}.my.salesforce.com", "id": "https://login.salesforce.com/id/[example]/[example]", "token_type": "Bearer", "issued_at": "1619193301063", "signature": "[example]" } ``` ### POST Login (for Community Users) `POST /` Operation ID: `Login (for Community Users)`. Tags: Login. Security: oauth2Auth. In the case of **Community users**, a step will be required prior to the generation of the Token itself, which will allow you to log in to the community manually, via OAuth2. For this, you will need to make an **Authentication call via OAuth2**, of the **Authorization Code** type, using as the domain the **URL of the Community** and passing in as parameters the **Callback URL** of the application, the **Client ID** and the **Client Token**. This information must be provided by the Marketplace to the Seller. To facilitate this process, it is possible \*\*to download the Postman Collection \*\*for this documentation, where the authentication call is already set up via OAuth2, with just the information for each Seller needing to be included in the environment variables. This call will open a **browser window**, where the Seller will log in normally with their Community user name, and **access will be cleared via API for that user**. Once the login has been performed, both a valid **access token** and a **refresh token** will be retrieved, which may be used subsequently to refresh the Access Token without manual action. The Token returned in **access\_token** must be saved and sent as a "Bearer Token" for all other calls, and must be refreshed when indicated with a return of 401 for a call. #### Responses * **200** Successful response Media type: `application/json`. ### POST Refresh Token (for Community Users) `POST /services/oauth2//token` Operation ID: `Refresh Token (for Community Users)`. Tags: Login. Security: oauth2Auth. After the initial generation of the Access Token and Refresh Token, or when the **generated Access Token expires**, it is necessary to execute an action to refresh the Token. To do this, a request of the type **Refresh Token** must be sent, with response type **Token**, together with the **Client ID**, **Client Secret** and **Callback URL** information. The response to this request will be a new Access Token, which can be used **immediately.**. **Note:** The **Refresh Token does not have an expiration set**, and will only become invalid if manually revoked. #### Request body Media type: `application/x-www-form-urlencoded`. Schema: `object`. * `grant_type` (_string_) Example: `refresh_token`. * `refresh_token` (_string_) Example: `{{refresh-token}}`. * `client_id` (_string_) Example: `{{client-id}}`. * `client_secret` (_string_) Example: `{{client-secret}}`. * `redirect_uri` (_string_) Example: `{{callback-url}}`. * `response_type` (_string_) Example: `token`. #### Responses * **200** OK Headers: * `Date` (string) Example: `Thu, 26 Aug 2021 13:57:25 GMT`. * `Strict-Transport-Security` (string) Example: `max-age=31536004; includeSubDomains`. * `X-Content-Type-Options` (string) Example: `nosniff`. * `X-XSS-Protection` (string) Example: `1; mode=block`. * `Cache-Control` (string) Example: `no-cache,must-revalidate,max-age=0,no-store,private`. * `Expires` (string) Example: `Thu, 01 Jan 1970 00:00:00 GMT`. * `Content-Type` (string) Example: `application/json;charset=UTF-8`. * `Vary` (string) Example: `Accept-Encoding`. * `Content-Encoding` (string) Example: `gzip`. * `Transfer-Encoding` (string) Example: `chunked`. Media type: `application/json`. Schema: `object`. _Example_ ``` { "access_token": "[example]", "refresh_token": "[example]", "sfdc_community_url": "https://[example].force.com", "sfdc_community_id": "[example]", "signature": "[example]", "scope": "refresh_token full", "id_token": "[example]", "instance_url": "https://{MyDomainName}.my.salesforce.com", "id": "https://test.salesforce.com/id/00D040000008gAEEAY/00504000001B7dgAAC", "token_type": "Bearer", "issued_at": "1629986245797" } ``` ### GET Query `GET /services/data/v51.0/query` Operation ID: `Query`. Tags: Login. Security: bearerAuth. To look up information about a seller, use the [Query](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/resources_query.htm) resource of the main REST API from Salesforce and set the value of the `q` parameter to an SOQL query. The following example is included in the query parameters section of this page with a corresponding example in the responses section: **Example 1 of 1**: `getSellerByExternalId` The value of seller-external-id must be provided by the marketplace and will be used to identify the Seller and serve as a key for when it is necessary to insert records pointing to the Seller object. The value of the seller-api-prefix must also be provided by the marketplace and will be used several times as the key for IDs. The call below returns the Seller’s basic details and can be used as an authentication test. #### Parameters * `q` (query, string) _Example: getSellerByExternalId_ ``` SELECT FIELDS(ALL) FROM Atonit_Mktplace__Seller__c WHERE Atonit_Mktplace__External_Id__c = '{{seller-external-id}}' LIMIT 200 ``` #### Responses * **200** OK Headers: * `Date` (string) Example: `Fri, 23 Apr 2021 16:00:05 GMT`. * `Strict-Transport-Security` (string) Example: `max-age=31536002; includeSubDomains`. * `X-Content-Type-Options` (string) Example: `nosniff`. * `X-XSS-Protection` (string) Example: `1; mode=block`. * `X-Robots-Tag` (string) Example: `none`. * `Cache-Control` (string) Example: `no-cache,must-revalidate,max-age=0,no-store,private`. * `Sforce-Limit-Info` (string) Example: `api-usage=1755/101002`. * `Content-Type` (string) Example: `application/json;charset=UTF-8`. * `Vary` (string) Example: `Accept-Encoding`. * `Content-Encoding` (string) Example: `gzip`. * `Transfer-Encoding` (string) Example: `chunked`. Media type: `application/json`. Schema: `object`. _Example: getSellerByExternalId_ ``` { "totalSize": 1, "done": true, "records": [ { "Id": "a0T5Y00000ZE4lFUAT", "Name": "S-004", "CreatedDate": "2021-03-22T21:38:39.000+0000", "LastModifiedDate": "2021-04-13T19:27:22.000+0000", "Atonit_Mktplace__Accepts_Marketplace_Shipping__c": false, "Atonit_Mktplace__Commercial_Conditions__c": null, "Atonit_Mktplace__CommissionPercent__c": 10, "Atonit_Mktplace__Delivery_Policy__c": "This is a delivery policy", "Atonit_Mktplace__Logo_URL__c": "https://via.placeholder.com/150C.png", "Atonit_Mktplace__ReleaseText__c": "This is a release text", "Atonit_Mktplace__Return_Policy__c": "This is a return policy", "Atonit_Mktplace__Slug__c": "atonit-vitta", "Atonit_Mktplace__External_Id__c": "atonit-vitta" } ] } ```