Overview
The login page provides the buyer authentication entry point for the storefront experience.
Salesforce Commerce supports multiple authentication and login integration patterns. Select the approach that best aligns with your organization's security, identity management, and domain requirements.
<!--The reference React storefront implementation uses Custom Apex Authentication to establish a site-scoped buyer session cookie that works across custom storefront domains. The following sections describe the supported login patterns and their implementation considerations.-->This flow demonstrates how a headless storefront can orchestrate custom Apex-based authentication experiences for buyer access and session management.
Authentication Approach
Choose OAuth-based authentication when integrating with external identity providers (IdPs), mobile applications, or workflows that require refresh token support.
B2B Commerce APIs Used in the Flow
<!--**Apex** | Operation | HTTP Method | Endpoint | | --------- | ----------- | ------------------------------- | | Apex auth | POST | `/services/apexrest/auth/login` | -->OAuth
| Operation | HTTP Method | Endpoint |
|---|---|---|
| OAuth authorize | GET | /services/oauth2/authorize |
| OAuth token | POST | /services/oauth2/token |
Buyer Journey
<!--**Submit Buyer Credentials Using Custom Apex REST Authentication** Use this option to authenticate buyers through a custom Apex REST implementation. The reference React storefront uses this approach to establish a site-scoped session cookie under a custom domain. 1. Call the following endpoint to initiate the login flow: `POST /services/data/v68.0/connect/identity/login-or-reg/init` Example request body: ```json { "identifier": "<buyer-identifier>", "channel": "<email-or-phone>", "action": "login" } ``` 2. Allow the platform to send a one-time verification code to the buyer. 3. Call the following endpoint to verify the challenge response: `POST /services/data/v68.0/connect/identity/login-or-reg/verify` Example request body: ```json { "challengeId": "<challenge-id>", "code": "<verification-code>" } ``` 4. Retrieve the `redirectUrl` value from the verification response. 5. Redirect the buyer to the returned URL to establish the authenticated storefront session. -->Authentication with OAuth
Use an OAuth-based authentication flow to integrate with an external Identity Provider (IdP). After the buyer session is established, storefront operations are decoupled from the underlying authentication mechanism and rely solely on the active session.
See Authorization Through External Client Apps or Connected Apps and OAuth 2.0 and Authorize Apps with OAuth for more information.