---
schema_version: "1"
id: 1aa289335bf06b1369e724dcafa27d967738a168a7e8c5d1d6c25974fbb4be13
title: "Sample Flow: Authorizing Guest Users and Calling Commerce APIs"
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/salesforce-commerce/guides/d2c-commerce/b2b-comm-headless-guest-jwt-sample-flow.md
canonical_url: https://developer.salesforce.com/docs/commerce/salesforce-commerce/guide/b2b-comm-headless-guest-jwt-sample-flow.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: b072fb249bd1995ee484818a700f472805094fd21c5083972b23017950ae6eff
products:
  - B2B Commerce Developer Guide
  - Salesforce APIs
---
# Sample Flow: Authorizing Guest Users and Calling Commerce APIs

Once the external client app is set up and you have the consumer details, including Consumer Key and Consumer Secret, you're ready to use the Headless Guest Flow. Issue identifiers in the form of unique visitor IDs (UVIDs) for these unknown visitors with the Headless Guest Flow. See [Headless Identity APIs: Headless Guest Flow for Public Clients](https://help.salesforce.com/s/articleView?id=sf.external_identity_headless_guest_flow.htm&type=5) for more information.

## Request Authorization Code for the Guest User

### Authorization

The first step is to authorize the guest user. The following is an example of an authorization request.

**Endpoint:** `(POST) https://<domain>.site.com/<site ID>/services/oauth2/authorize`

**Request**

**Header:**

```json
Uvid-Hint: UVID abcd-1234-efgh
Auth-Request-Type: guest
```

**Body:**

```json
response_type=code_credentials&
client_id=***********&
redirect_uri=https://www.MyExperienceCloudSite.my.site.com/services/oauth2/echo&
code_challenge=********&
scope=openid
```

**Response**

Salesforce validates the UVID and authorizes the guest user. If the UVID was passed as a JWT-based access token, Salesforce checks the validity of the token. The API returns the code response with the authorization and other parameters.

```json
{
  "code": "aPrxhgBwK8L6...",
  "state": "optional_state_parameter"
}
```

### Token Exchange (Tokenization)

After authorization is complete, exchange the authorization code for a JWT access token.

**Header:**

```json
Uvid-Hint: UVID abcd-1234-efgh
Auth-Request-Type: guest
```

**Note:** For guest user authentication flows, include the Uvid-Hint and Auth-Request-Type guest headers in the token request. Requests that omit these headers can return an unknown_error response.

**Endpoint:** `(POST) https://<domain>.site.com/<site ID>/services/oauth2/token`

**Request**

**Body:**

```json
grant_type=authorization_code
code={AUTHORIZATION_CODE} /*Received using the Authorize POST request*/
client_id={CONSUMER_KEY}
client_secret={CONSUMER_SECRET}
redirect_uri={CALLBACK_URL}
```

**Response**

Your app processes the access token response and creates a guest session, persisting the UVID value.

```json
{
  "access_token": "00D5g000000xxxx!AQwAQH...",
  "token_format": "jwt",
  "token_type": "Bearer"
}
```

## Use Commerce APIs

Use the JWT token to interact with Commerce APIs.

### Create Cart

**Endpoint:** `(POST) https://<domain>.site.com/<site ID>/services/data/vXX.X/commerce/webstores/{webstoreId}/carts?currencyIsoCode=USD&language=en-US&asGuest=true&htmlEncode=false`

See [Commerce Webstore, Create Cart](https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/connect_resources_commerce_webstore_carts.htm) for more information.

### Add Items to Cart

**Endpoint:** `(POST) https://<domain>.site.com/<site ID>/services/data/vXX.X/commerce/webstores/{webstoreId}/carts/{cartId}/cart-items?currencyIsoCode=USD&language=en-US&asGuest=true&htmlEncode=false`

See [Commerce Webstore, Add Items to Cart](https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/connect_resources_commerce_webstore_cart_items.htm) for more information.

### Checkout Flow

**Start Checkout:**

**Endpoint:** `(POST) https://<domain>.site.com/<site ID>/services/data/vXX.X/commerce/webstores/{webstoreId}/carts/{cartId}/checkouts?currencyIsoCode=USD&language=en-US&asGuest=true&htmlEncode=false`

To continue with the checkout process, choose the Checkout API that best fits your implementation requirements:

- [Commerce Webstore, Checkout Orders](https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/connect_resources_commerce_webstore_checkout.htm)—Single-step order placement.
- [Commerce Webstore Checkout, Place Order Action](https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/connect_resources_commerce_webstore_checkout_place_order.htm)—Two-step process: Prepare and Submit.