---
schema_version: "1"
id: 474a798859442a3573ada6287cfa1804d8344c9a2409281fa4a42b92ac4bb825
title: Use a SLAS Private Client
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/pwa-kit-managed-runtime/guides/use-a-slas-private-client.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/use-a-slas-private-client.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 551956b1ae369e475f5e08125dd3d169a811c4eabae69f5daa391c27f3746605
products:
  - Composable Storefront
  - Salesforce APIs
---
# Use a SLAS Private Client

[Shopper Login and API Access (SLAS) API Clients](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html) allow your application to authenticate and authorize shoppers. SLAS clients come in two types: public and private.

SLAS private clients offer several advantages over a public client, including:

- Pre-authorize guest shoppers to request access to a store which results in faster page load times.
- Enable the use of features not available to SLAS public clients including passwordless login and password reset. See [Private SLAS Client Use Cases](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-private-client.html).

To take advantage of a SLAS private client, your project must be able to securely store a client secret.

Consider using a public client if your project runs client-side and must communicate with SLAS directly.

PWA Kit 3.5 and above supports the use of both SLAS public and and private clients.

**note:** All PWA versions prior to PWA Kit 3.5 support only SLAS _public_ clients.

If you have an existing PWA Kit site using a SLAS public client, we encourage you to [read on](#set-up-a-slas-private-client) and consider switching to a private client.

Before running the commands in this guide, replace any placeholders with actual values. Placeholders are formatted like this: \$PLACEHOLDER.

## Private Client Secrets

When working with private clients, care should be taken to not expose the client secret to shoppers and client-side browsers.

To help secure the client secret, the PWA Kit Retail React App stores the secret server-side through the use of environment variables. See [Set Environment Variables](#set-environment-variables) for information on how to store the client secret.

## Set up a SLAS Private Client

At a high level, you'll do the following to set up a SLAS private client with your PWA Kit site.

- Create the SLAS private client
- Configure the PWA Kit
- Set environment variables

This video shows you how to set up a SLAS private client for the PWA Kit and a [phased Headless rollout](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/phased-headless-rollouts.html).

::video{src="https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/FqwkbNxGVXVsLCxQDGMP3g" title="SLAS Private Client in a Composable Storefront" type="vidyard"}

### Create a SLAS Private Client

Start by completing the instructions in [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guides/authorization-for-shopper-apis.md) and [Set Up API Access](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/setting-up-api-access.md) to create your SLAS Private Client.

To initialize an Agentforce session, obtain a SLAS shopper access token that includes the `sfcc.shopper-agents.rw` scope, and then call the [Shopper Agents API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-agents?meta=Summary) with the `sessionInitKey` received at session start.
The Shopper Agent API starts the Agentforce session and associates it with the shopper context that `sessionInitKey` references. It doesn't move profile or basket data. Any access to shopper data continues via standard Shopper APIs, governed by your SLAS token’s scopes.

For CLI client creation, see [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guides/authorization-for-shopper-apis.md#slas-admin-ui-create-a-slas-client).

### Configure the PWA Kit

Once you have created your SLAS private client, follow the steps below to use it with your PWA Kit site:

1. If you haven't already done so, upgrade to PWA Kit v3.5 or above.
2. In your PWA Kit configuration file (`config/default.js`), set your commerceAPI clientId to your SLAS private client ID.

   ```jsx
   clientId: '$YOUR_SLAS_PRIVATE_CLIENT_ID',
   ```

3. In your `_app-config/index.js`, set the `enablePWAKitPrivateClient` prop of `<CommerceAPIProvider>` to `true`.
   ```jsx
   CommerceApiProvider enablePWAKitPrivateClient={true}
   ```
4. In your `ssr.js`, set the `useSLASPrivateClient` property of options pass to `runtime.createHandler` to `true`:

   ```js
   const options = {useSLASPrivateClient: true}
   const {handler} = runtime.createHandler(options, callback)
   ```

### Set Environment Variables

#### Local Environment

Run the following command to set the `PWA_KIT_SLAS_CLIENT_SECRET` environment variable locally in an active command prompt:

- On Mac / Unix, run `export PWA_KIT_SLAS_CLIENT_SECRET=$YOUR_CLIENT_SECRET`
- On Windows, run `set PWA_KIT_SLAS_CLIENT_SECRET=$YOUR_CLIENT_SECRET`

**note:** In a local development environment, you will want to set the `PWA_KIT_SLAS_CLIENT_SECRET` more permanently so that it is included automatically when you open a new command prompt.

On Mac / Unix, you can do this by setting the `PWA_KIT_SLAS_CLIENT_SECRET` environment variable in your machine's `.bashrc` file.
On Windows, you can do this by setting the `PWA_KIT_SLAS_CLIENT_SECRET` environment variable via Control Panel -> System -> Advanced -> Environment Variables.

#### MRT (Managed Runtime) Environment

If you are running your PWA Kit site remotely on Managed Runtime, you can set the `PWA_KIT_SLAS_CLIENT_SECRET` environment variable by running the following command in your terminal after replacing the variables to match with your environment.

For details on how to get a Managed Runtime API key and other properties of your remote environment, refer to our [Push and Deploy Bundles guide](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/pushing-and-deploying-bundles.html).

```bash
curl "https://cloud.mobify.com/api/projects/$PROJECTID/target/$ENVIRONMENTID/env-var/" \
  --request 'PATCH' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer $RUNTIME_ADMIN_API_KEY" \
  --data '{ "PWA_KIT_SLAS_CLIENT_SECRET": {"value": "'$PWA_KIT_SLAS_CLIENT_SECRET'"} }'
```

For more information, see [Environment Variables](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/environment-variables.md).

### Setup for Phased Headless Rollouts

**note:** This setup applies to a hybrid storefront that uses Plugin SLAS. It doesn't apply if you're using [hybrid authentication](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/hybrid-auth.md).

In addition to the PWA Kit setup steps described above, on a Phased Launch storefront that is using both PWA Kit and SFRA, you will also want to update Plugin SLAS to use your SLAS private client. See the [Plugin SLAS readme](https://github.com/SalesforceCommerceCloud/plugin_slas) for instructions on how to set up a SLAS private client to work with SFRA.

## Additional Endpoint

If you're extending your PWA Kit implementation to use other SLAS endpoints that require private clients like Passwordless Login, you can extend the set of endpoints available using the `applySLASPrivateClientToEndpoints` option for `runtime.createHandler`:

```js
const options = {
  useSLASPrivateClient: true,
  applySLASPrivateClientToEndpoints: /oauth2\/(token|passwordless\/(login|token))/
}
const {handler} = runtime.createHandler(options, callback)
```

## Troubleshooting

- If you see HTTP 400 calls to SLAS [/authorize](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizeCustomer), the PWA Kit site is using the SLAS public client flows with your private client ID. In your `_app-config/index.js` file, set the `enablePWAKitPrivateClient` prop inside the CommerceAPIProvider to `true`.

- On a local development environment, the PWA Kit server will not start if the `useSLASPrivateClient` property is enabled in `ssr.js` and the `PWA_KIT_SLAS_CLIENT_SECRET` environment variable has not been set. [Set the environment variable](#set-environment-variables) to your SLAS client secret to continue.

- After deploying your PWA Kit site to Managed Runtime, if you see an HTTP 501 error when making a call to SLAS, it could mean the `PWA_KIT_SLAS_CLIENT_SECRET` environment variable has not been set. After setting it, please wait e a few minutes for the change to apply.

## See Also

- [Public SLAS Client Use Cases](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-public-client.html)
- [Private SLAS Client Use Cases](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-private-client.html)
- [Phased Headless Rollouts](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/phased-headless-rollouts.html)
- [Passwordless Login](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login.html)
- [Password Reset](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-password-reset.html)