import { BaseClient, ClientConfig, Response } from "@commerce-apps/core";
import type { CommonParameters } from "@commerce-apps/core";
import type { OperationOptions } from "retry";
import type { RequestInit } from "node-fetch";
import type { CompositeParameters, CustomRequestBody, QueryParameters, RequireParametersUnlessAllAreOptional } from "../../types";
import type { AuthenticateFinishRequest, AuthenticateResult, GrantType, PasskeyUser, PublicKeyCredentialRequestOptions, RegistrationFinishRequest, ResponseType, TokenActionRequest, TokenResponse } from '../models/index';
export type AuthorizeCustomerResponseTypeEnum = 'code';
export type AuthorizeCustomerScopeEnum = 'openid' | 'offline_access' | 'email';
export type AuthorizePasswordlessCustomerModeEnum = 'callback' | 'sms' | 'email';
export type AuthorizeWebauthnRegistrationModeEnum = 'callback' | 'sms' | 'email';
export type GetPasswordLessAccessTokenGrantTypeEnum = 'authorization_code' | 'refresh_token' | 'client_credentials' | 'authorization_code_pkce' | 'session_bridge';
export type GetPasswordResetTokenModeEnum = 'callback' | 'sms' | 'email';
export type GetSessionBridgeAccessTokenGrantTypeEnum = 'authorization_code' | 'refresh_token' | 'client_credentials' | 'authorization_code_pkce' | 'session_bridge';
export type GetTrustedAgentAccessTokenGrantTypeEnum = 'authorization_code' | 'refresh_token' | 'client_credentials' | 'authorization_code_pkce' | 'session_bridge';
export type GetTrustedAgentAuthorizationTokenResponseTypeEnum = 'code';
export type GetTrustedSystemAccessTokenGrantTypeEnum = 'authorization_code' | 'refresh_token' | 'client_credentials' | 'authorization_code_pkce' | 'session_bridge';
export type GetTrustedSystemAccessTokenHintEnum = 'ts_ext_on_behalf_of';
export type GetTrustedSystemAccessTokenIdpOriginEnum = 'apple' | 'auth0' | 'azure' | 'azure_adb2c' | 'cognito' | 'default' | 'ecom' | 'facebook' | 'forgerock' | 'gigya' | 'gigya_socialize' | 'google' | 'okta' | 'ping' | 'salesforce';
export type IntrospectTokenTokenTypeHintEnum = 'access_token' | 'refresh_token';
export type LogoutCustomerHintEnum = 'all-sessions';
export type RequestOtpModeEnum = 'callback' | 'sms' | 'email';
export type RevokeTokenTokenTypeHintEnum = 'access_token' | 'refresh_token';
export type authenticateCustomerBodyType = {
client_id?: string;
response_type?: ResponseType;
redirect_uri: string;
state?: string;
scope?: string;
usid?: string;
channel_id: string;
code_challenge?: string;
};
export type authorizePasswordlessCustomerBodyType = {
user_id: string;
mode: string;
locale?: string;
usid?: string;
channel_id: string;
callback_uri?: string;
last_name?: string;
email?: string;
first_name?: string;
phone_number?: string;
customer_no?: string;
};
export type authorizeWebauthnRegistrationBodyType = {
user_id: string;
mode: string;
channel_id: string;
locale?: string;
client_id?: string;
code_challenge?: string;
callback_uri?: string;
idp_name?: string;
hint?: string;
};
export type getAccessTokenBodyType = {
refresh_token?: string;
code?: string;
usid?: string;
grant_type: GrantType;
redirect_uri?: string;
code_verifier?: string;
client_id?: string;
channel_id?: string;
dnt?: string;
};
export type getPasswordLessAccessTokenBodyType = {
grant_type: string;
hint: string;
pwdless_login_token: string;
client_id?: string;
code_verifier?: string;
login_id?: string;
};
export type getPasswordResetTokenBodyType = {
user_id: string;
mode: string;
channel_id: string;
locale?: string;
client_id?: string;
code_challenge?: string;
callback_uri?: string;
idp_name?: string;
hint?: string;
};
export type getSessionBridgeAccessTokenBodyType = {
code: string;
client_id: string;
channel_id: string;
code_verifier: string;
dwsid: string;
grant_type: string;
login_id: string;
dwsgst?: string;
dwsrst?: string;
usid?: string;
dnt?: string;
};
export type getTrustedAgentAccessTokenBodyType = {
agent_id?: string;
client_id: string;
channel_id: string;
code_verifier: string;
grant_type: string;
login_id: string;
idp_origin: string;
usid?: string;
dnt?: string;
state?: string;
};
export type getTrustedSystemAccessTokenBodyType = {
usid?: string;
grant_type: string;
hint: string;
login_id: string;
idp_origin: string;
client_id: string;
channel_id: string;
email_id?: string;
dnt?: string;
};
export type introspectTokenBodyType = {
token: string;
token_type_hint?: string;
};
export type requestOtpBodyType = {
client_id: string;
channel_id: string;
user_id: string;
mode: string;
email?: string;
callback_uri?: string;
locale?: string;
};
export type resetPasswordBodyType = {
client_id: string;
pwd_action_token: string;
code_verifier?: string;
new_password?: string;
channel_id: string;
hint?: string;
user_id?: string;
};
export type revokeTokenBodyType = {
token: string;
token_type_hint?: string;
};
export type startWebauthnAuthenticationBodyType = {
tenant_id?: string;
client_id: string;
channel_id: string;
user_id?: string;
};
export type startWebauthnUserRegistrationBodyType = {
client_id?: string;
pwd_action_token: string;
user_id: string;
channel_id: string;
display_name?: string;
nick_name?: string;
};
export type verifyOtpBodyType = {
pwd_action_token: string;
client_id: string;
channel_id: string;
user_id: string;
};
/**
* [Auth](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=auth:Summary)
* ==================================
*
* *[Download API specification](https://developer.salesforce.com/static/commercecloud/commerce-api/auth/auth-oas-v1-public.yaml)
# API Overview
The Shopper Login and API Access Service (SLAS) enables secure access to Commerce Cloud’s Shopper APIs for a wide range of headless commerce applications.
**Important:** Before using this API, see [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-shopper-apis.html) in the Get Started guides and the more detailed [SLAS guides](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html) for instructions on setting up a SLAS client, obtaining credentials, as well as flow and use case information.
For load shedding and rate limiting information, see [Load Shedding and Rate Limiting.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/throttle-rates.html)*
*
* For instructions on how to retrieve access token for admin APIs: https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-admin-apis.html
* Example with admin auth
*
* ```typescript
* import { ShopperLogin, ClientConfig } from "commerce-sdk";
* // or
* const { ShopperLogin, ClientConfig } = require("commerce-sdk");
*
* const clientConfig: ClientConfig = {
* parameters: {
* clientId: "XXXXXX",
* organizationId: "XXXX",
* shortCode: "XXX",
* siteId: "XX"
* }
* };
*
* token = { access_token: 'INSERT_ACCESS_TOKEN_HERE' };
*
* clientConfig.headers['authorization'] = `Bearer ${token.access_token}`;
* const authClient = new ShopperLogin(clientConfig);
* ```
*
*
* API Version: 1.4.4
* Last Updated:
*
*
*/
export declare class ShopperLogin extends BaseClient {
constructor(config: ClientConfig);
/**
* This follows the authorization code grant flow as defined by the OAuth 2.1 standard. It also uses a proof key for code exchange (PKCE).
For PKCE values:
- The `code_verifier` string is a random string used for the `/token` endpoint request.
- The `code_challenge` is an encoded version of the `code_verifier` string using an SHA-256 hash.
The request must include a basic authorization header that contains a Base64 encoded version of the following string: `:`.
Required parameters: `code_challenge`, `channel_id`, `client_id`, and `redirect_uri`.
Optional parameters: `usid`.
The SLAS `/login` endpoint redirects back to the redirect URI and returns an authorization code.
Calls to `/login` made with the same loginId and tenantId within 1 second result in a conflict.
*
* If you would like to get a raw Response object use the other authenticateCustomer function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.client_id - SLAS client ID. Required when the grant type is `authorization_code_pkce`.
* @param options.body.response_type - Must be `code`. Indicates that the client wants an authorization code (when the grant type is `authorization_code`).
* @param options.body.redirect_uri - The URI to which the server redirects the browser after the user grants the authorization. The URI must be registered with the SLAS client. A variety of URI formats and wildcards for host are supported, but app links like airbnb:// or fb:// are not. Examples of supported URIs: Examples of supported URIs: - `http://localhost:3000/callback` - `https://example.com/callback` - `com.example.app:redirect_uri_path` - ` *.subdomain.topleveldomain.com`
* @param options.body.state - Value to be sent by the client to determine the state between the authorization request and the server response. Optional, but strongly recommended.
* @param options.body.scope - Scopes to limit an application\'s access to a user\'s account.
* @param options.body.usid - The unique shopper ID.
* @param options.body.channel_id - The channel that the request is for. For a B2C Commerce request, this is angalous to the site ID.
* @param options.body.code_challenge - PKCE code verifier. Created by the client calling the `login` endpoint. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_challenge` is optional when using a private client id for the token request.
*
* @returns A promise of type void.
*/
authenticateCustomer(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: authenticateCustomerBodyType;
}>): Promise;
/**
* This follows the authorization code grant flow as defined by the OAuth 2.1 standard. It also uses a proof key for code exchange (PKCE).
For PKCE values:
- The `code_verifier` string is a random string used for the `/token` endpoint request.
- The `code_challenge` is an encoded version of the `code_verifier` string using an SHA-256 hash.
The request must include a basic authorization header that contains a Base64 encoded version of the following string: `:`.
Required parameters: `code_challenge`, `channel_id`, `client_id`, and `redirect_uri`.
Optional parameters: `usid`.
The SLAS `/login` endpoint redirects back to the redirect URI and returns an authorization code.
Calls to `/login` made with the same loginId and tenantId within 1 second result in a conflict.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.client_id - SLAS client ID. Required when the grant type is `authorization_code_pkce`.
* @param options.body.response_type - Must be `code`. Indicates that the client wants an authorization code (when the grant type is `authorization_code`).
* @param options.body.redirect_uri - The URI to which the server redirects the browser after the user grants the authorization. The URI must be registered with the SLAS client. A variety of URI formats and wildcards for host are supported, but app links like airbnb:// or fb:// are not. Examples of supported URIs: Examples of supported URIs: - `http://localhost:3000/callback` - `https://example.com/callback` - `com.example.app:redirect_uri_path` - ` *.subdomain.topleveldomain.com`
* @param options.body.state - Value to be sent by the client to determine the state between the authorization request and the server response. Optional, but strongly recommended.
* @param options.body.scope - Scopes to limit an application\'s access to a user\'s account.
* @param options.body.usid - The unique shopper ID.
* @param options.body.channel_id - The channel that the request is for. For a B2C Commerce request, this is angalous to the site ID.
* @param options.body.code_challenge - PKCE code verifier. Created by the client calling the `login` endpoint. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_challenge` is optional when using a private client id for the token request.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type void otherwise.
*/
authenticateCustomer(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: authenticateCustomerBodyType;
}>, rawResponse?: T): Promise;
/**
* This is the first step of the OAuth 2.1 authorization code flow, in which a user can log in via federation to the IDP configured for the client. After successfully logging in, the user gets an authorization code via a redirect URI.
You can call this endpoint from the front channel (the browser).
*
* If you would like to get a raw Response object use the other authorizeCustomer function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.redirect_uri - The redirect for Account Manager to redirect to. A variety of URI formats and wildcard for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs:
- `http://localhost:3000/callback`
- `https://example.com/callback`
- `com.example.app:redirect_uri_path`
- ` *.subdomain.topleveldomain.com`
* @param options.parameters.response_type - Must be `code`. Indicates that the caller wants an authorization code.
* @param options.parameters.client_id - The SLAS public client ID or SLAS private client ID for use with trusted-agent requests. When using a private client ID a PKCE code challenge is not required.
* @param options.parameters.scope -
* @param options.parameters.state - Value to send the client to determine the state between the authorization request and the server response. Optional, but strongly recommended.
* @param options.parameters.usid - A unique shopper identifier (USID). If not provided, a new USID is generated.
* @param options.parameters.hint - Name of an identity provider (IDP) to optionally redirect to, thereby skipping the IDP selection step.
To use a public client, set `hint` to `guest` and use a public client ID to get an authorization code. If no `hint` is provided, the preferred IDP of the tenant is used by default.
For session bridge authorization the `hint` should be set to `sb-user` for a registered customer and to `sb-guest` for a guest. For session bridge authorization the SLAS Client `sfcc.session_bridge` scope.
* @param options.parameters.channel_id - The channel that this request is for. For a B2C Commerce request, this is angalous to the site ID.
* @param options.parameters.code_challenge - PKCE code challenge. Created by the caller.
The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash.
The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters.
The *`code_challenge` and 'code_verifier'* are required if a using SLAS public `client_id`.
* @param options.parameters.ui_locales - End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For example, the value `fr-CA fr en` represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
In most cases the IDP supports one language tag and has a default language set on the server. SLAS will support the space-separated list and pass them to the IDP.
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
*
* @returns A promise of type void.
*/
authorizeCustomer(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
redirect_uri: string;
response_type: AuthorizeCustomerResponseTypeEnum;
client_id: string;
scope?: AuthorizeCustomerScopeEnum;
state?: string;
usid?: string;
hint?: string;
channel_id?: string;
code_challenge?: string;
ui_locales?: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
}>): Promise;
/**
* This is the first step of the OAuth 2.1 authorization code flow, in which a user can log in via federation to the IDP configured for the client. After successfully logging in, the user gets an authorization code via a redirect URI.
You can call this endpoint from the front channel (the browser).
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.redirect_uri - The redirect for Account Manager to redirect to. A variety of URI formats and wildcard for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs:
- `http://localhost:3000/callback`
- `https://example.com/callback`
- `com.example.app:redirect_uri_path`
- ` *.subdomain.topleveldomain.com`
* @param options.parameters.response_type - Must be `code`. Indicates that the caller wants an authorization code.
* @param options.parameters.client_id - The SLAS public client ID or SLAS private client ID for use with trusted-agent requests. When using a private client ID a PKCE code challenge is not required.
* @param options.parameters.scope -
* @param options.parameters.state - Value to send the client to determine the state between the authorization request and the server response. Optional, but strongly recommended.
* @param options.parameters.usid - A unique shopper identifier (USID). If not provided, a new USID is generated.
* @param options.parameters.hint - Name of an identity provider (IDP) to optionally redirect to, thereby skipping the IDP selection step.
To use a public client, set `hint` to `guest` and use a public client ID to get an authorization code. If no `hint` is provided, the preferred IDP of the tenant is used by default.
For session bridge authorization the `hint` should be set to `sb-user` for a registered customer and to `sb-guest` for a guest. For session bridge authorization the SLAS Client `sfcc.session_bridge` scope.
* @param options.parameters.channel_id - The channel that this request is for. For a B2C Commerce request, this is angalous to the site ID.
* @param options.parameters.code_challenge - PKCE code challenge. Created by the caller.
The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash.
The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters.
The *`code_challenge` and 'code_verifier'* are required if a using SLAS public `client_id`.
* @param options.parameters.ui_locales - End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For example, the value `fr-CA fr en` represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
In most cases the IDP supports one language tag and has a default language set on the server. SLAS will support the space-separated list and pass them to the IDP.
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type void otherwise.
*/
authorizeCustomer(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
redirect_uri: string;
response_type: AuthorizeCustomerResponseTypeEnum;
client_id: string;
scope?: AuthorizeCustomerScopeEnum;
state?: string;
usid?: string;
hint?: string;
channel_id?: string;
code_challenge?: string;
ui_locales?: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
}>, rawResponse?: T): Promise;
/**
* This endpoint allows customers to authenticate when their configured identity provider is inaccessible. It provides an alternative authentication path through passwordless login methods like email or SMS verification.
*
* If you would like to get a raw Response object use the other authorizePasswordlessCustomer function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.register_customer - When set to `true`, creates a new customer profile in B2C Commerce if one doesn't already exist. Requires `last_name` and `email` body parameters unless `user_id` is an email address. Optionally accepts `first_name` and `phone_number` body parameters.
If the customer profile doesn't exist, it is created when the TOTP is validated via the `passwordless/token` endpoint.
When set to `false` (or omitted), no customer profile is created in B2C Commerce.
* @param options.parameters.strict_verify - When set to `true`, blocks the passwordless login request and returns a `400` error if the shopper's email is not verified. Use this to enforce shopper email verification before allowing passwordless authentication. Available in B2C Commerce version 26.6 and later.
Default: `false`
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.user_id - User ID for logging in.
* @param options.body.mode - Password Action delivery modes
* @param options.body.locale - The locale of the template. Required when the mode is `email` or `sms`.
* @param options.body.usid - The shopper\'s unique identifier, if known. If not provided, a new USID is generated.
* @param options.body.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.body.callback_uri - The callback URI. Required when the mode is `callback`. The `callback_uri` property will be validated against the callback URIs that have been registered with the SLAS client. The callback URI _must_ be a `POST` endpoint because the token will be included in the body. Wildcards are not allowed in the callback_uri because this is a security risk that can expose the token. This is not considered an OAuth2 callback_url.
* @param options.body.last_name - The user\'s last name. Required when `register_customer` is `true`. The `last_name` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.email - The user\'s email address. Required when `register_customer` is `true` and `user_id` is not an email address. The `email` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.first_name - The user\'s first name. Optional when `register_customer` is `true`. The `first_name` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.phone_number - The user\'s phone number. Optional when `register_customer` is `true`. The `phone_number` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.customer_no - The customer number assigned to the shopper profile when `register_customer` is set to `true`. If the `customer_no` already exists, the request fails. The `customer_no` parameter is optional and only used when `register_customer` is set to `true`.
*
* @returns A promise of type string.
*/
authorizePasswordlessCustomer(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
register_customer?: string;
strict_verify?: boolean;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: authorizePasswordlessCustomerBodyType;
}>): Promise;
/**
* This endpoint allows customers to authenticate when their configured identity provider is inaccessible. It provides an alternative authentication path through passwordless login methods like email or SMS verification.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.register_customer - When set to `true`, creates a new customer profile in B2C Commerce if one doesn't already exist. Requires `last_name` and `email` body parameters unless `user_id` is an email address. Optionally accepts `first_name` and `phone_number` body parameters.
If the customer profile doesn't exist, it is created when the TOTP is validated via the `passwordless/token` endpoint.
When set to `false` (or omitted), no customer profile is created in B2C Commerce.
* @param options.parameters.strict_verify - When set to `true`, blocks the passwordless login request and returns a `400` error if the shopper's email is not verified. Use this to enforce shopper email verification before allowing passwordless authentication. Available in B2C Commerce version 26.6 and later.
Default: `false`
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.user_id - User ID for logging in.
* @param options.body.mode - Password Action delivery modes
* @param options.body.locale - The locale of the template. Required when the mode is `email` or `sms`.
* @param options.body.usid - The shopper\'s unique identifier, if known. If not provided, a new USID is generated.
* @param options.body.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.body.callback_uri - The callback URI. Required when the mode is `callback`. The `callback_uri` property will be validated against the callback URIs that have been registered with the SLAS client. The callback URI _must_ be a `POST` endpoint because the token will be included in the body. Wildcards are not allowed in the callback_uri because this is a security risk that can expose the token. This is not considered an OAuth2 callback_url.
* @param options.body.last_name - The user\'s last name. Required when `register_customer` is `true`. The `last_name` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.email - The user\'s email address. Required when `register_customer` is `true` and `user_id` is not an email address. The `email` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.first_name - The user\'s first name. Optional when `register_customer` is `true`. The `first_name` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.phone_number - The user\'s phone number. Optional when `register_customer` is `true`. The `phone_number` parameter is not used when `register_customer` parameter is not added or is `false`.
* @param options.body.customer_no - The customer number assigned to the shopper profile when `register_customer` is set to `true`. If the `customer_no` already exists, the request fails. The `customer_no` parameter is optional and only used when `register_customer` is set to `true`.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type string otherwise.
*/
authorizePasswordlessCustomer(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
register_customer?: string;
strict_verify?: boolean;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: authorizePasswordlessCustomerBodyType;
}>, rawResponse?: T): Promise;
/**
* Authorizes a user to register a WebAuthn credential (passkey). This endpoint validates the user's
credentials and creates a password action token that can be used to start the registration process.
The token is sent to the user via the specified channel (email or SMS).
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
*
* If you would like to get a raw Response object use the other authorizeWebauthnRegistration function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.user_id - User ID for logging in. This is the id that is used to log into SFCC.
* @param options.body.mode - Password Action delivery modes
* @param options.body.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.body.locale - The locale of the template. Required when the mode is `email` or `sms`.
* @param options.body.client_id - -| The public client ID. Requires setting `grant_type` to `passwordless_login_pkce`. When using the `hint` query parameter either a public or private client ID can be used.
* @param options.body.code_challenge - PKCE code challenge. Created by the client. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. Requires setting `grant_type` to `passwordless_login_pkce`
* @param options.body.callback_uri - The callback uri. Required when the mode is `callback`. The `callback_uri` property will be validated against the callback URIs that have been registered with the SLAS client. The callback URI _must_ be a `POST` endpoint because the token will be included in the body. Wildcards are not allowed in the callback_uri because this is a security risk that can expose the token. This is not considered an OAuth2 callback_url.
* @param options.body.idp_name - The name of the 3rd party identity provider for the user ID
* @param options.body.hint - Adding a `hint` query parameter with a value of `cross_device` will remove the need to have the code_challenge for password reset request. If the `hint` query parameter is used it must also be used in the password reset request.
*
* @returns A promise of type void.
*/
authorizeWebauthnRegistration(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: authorizeWebauthnRegistrationBodyType;
}>): Promise;
/**
* Authorizes a user to register a WebAuthn credential (passkey). This endpoint validates the user's
credentials and creates a password action token that can be used to start the registration process.
The token is sent to the user via the specified channel (email or SMS).
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.user_id - User ID for logging in. This is the id that is used to log into SFCC.
* @param options.body.mode - Password Action delivery modes
* @param options.body.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.body.locale - The locale of the template. Required when the mode is `email` or `sms`.
* @param options.body.client_id - -| The public client ID. Requires setting `grant_type` to `passwordless_login_pkce`. When using the `hint` query parameter either a public or private client ID can be used.
* @param options.body.code_challenge - PKCE code challenge. Created by the client. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. Requires setting `grant_type` to `passwordless_login_pkce`
* @param options.body.callback_uri - The callback uri. Required when the mode is `callback`. The `callback_uri` property will be validated against the callback URIs that have been registered with the SLAS client. The callback URI _must_ be a `POST` endpoint because the token will be included in the body. Wildcards are not allowed in the callback_uri because this is a security risk that can expose the token. This is not considered an OAuth2 callback_url.
* @param options.body.idp_name - The name of the 3rd party identity provider for the user ID
* @param options.body.hint - Adding a `hint` query parameter with a value of `cross_device` will remove the need to have the code_challenge for password reset request. If the `hint` query parameter is used it must also be used in the password reset request.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type void otherwise.
*/
authorizeWebauthnRegistration(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: authorizeWebauthnRegistrationBodyType;
}>, rawResponse?: T): Promise;
/**
* This endpoint deletes a specific WebAuthn passkey credential for a user.
The endpoint validates the Shopper JWT signature and ensures that the loginId, organizationId,
and channel_id in the token match the values in the path and query parameters.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
This endpoint requires Shopper JWT authentication.
*
* If you would like to get a raw Response object use the other deletePasskeyCredential function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.parameters.loginId - The login ID (username) of the user whose passkey credential is being deleted
* @param options.parameters.credentialId - The unique identifier of the credential to delete
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
*
* @returns A promise of type void.
*/
deletePasskeyCredential(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
channel_id: string;
loginId: string;
credentialId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
}>): Promise;
/**
* This endpoint deletes a specific WebAuthn passkey credential for a user.
The endpoint validates the Shopper JWT signature and ensures that the loginId, organizationId,
and channel_id in the token match the values in the path and query parameters.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
This endpoint requires Shopper JWT authentication.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.parameters.loginId - The login ID (username) of the user whose passkey credential is being deleted
* @param options.parameters.credentialId - The unique identifier of the credential to delete
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type void otherwise.
*/
deletePasskeyCredential(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
channel_id: string;
loginId: string;
credentialId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
}>, rawResponse?: T): Promise;
/**
* This endpoint deletes a user's WebAuthn passkey information and all associated credentials.
The endpoint validates the Shopper JWT signature and ensures that the loginId, organizationId,
and channel_id in the token match the values in the path and query parameters.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
This endpoint requires Shopper JWT authentication.
*
* If you would like to get a raw Response object use the other deletePasskeyUser function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.parameters.loginId - The login ID (username) of the user whose passkey information is being deleted
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
*
* @returns A promise of type void.
*/
deletePasskeyUser(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
channel_id: string;
loginId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
}>): Promise;
/**
* This endpoint deletes a user's WebAuthn passkey information and all associated credentials.
The endpoint validates the Shopper JWT signature and ensures that the loginId, organizationId,
and channel_id in the token match the values in the path and query parameters.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
This endpoint requires Shopper JWT authentication.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.parameters.channel_id - The channel (B2C Commerce site) that the user is associated with.
* @param options.parameters.loginId - The login ID (username) of the user whose passkey information is being deleted
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type void otherwise.
*/
deletePasskeyUser(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
channel_id: string;
loginId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
}>, rawResponse?: T): Promise;
/**
* Completes the WebAuthn authentication process by verifying the assertion from the authenticator.
Returns OAuth tokens upon successful authentication.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
*
* If you would like to get a raw Response object use the other finishWebauthnAuthentication function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
*
* @returns A promise of type AuthenticateResult.
*/
finishWebauthnAuthentication(options: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: AuthenticateFinishRequest & CustomRequestBody;
}>): Promise;
/**
* Completes the WebAuthn authentication process by verifying the assertion from the authenticator.
Returns OAuth tokens upon successful authentication.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type AuthenticateResult otherwise.
*/
finishWebauthnAuthentication(options: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: AuthenticateFinishRequest & CustomRequestBody;
}>, rawResponse?: T): Promise;
/**
* Completes the WebAuthn registration process by verifying the credential created by the authenticator.
Stores the public key and credential information for future authentication.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
*
* If you would like to get a raw Response object use the other finishWebauthnUserRegistration function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
*
* @returns A promise of type void.
*/
finishWebauthnUserRegistration(options: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: RegistrationFinishRequest & CustomRequestBody;
}>): Promise;
/**
* Completes the WebAuthn registration process by verifying the credential created by the authenticator.
Stores the public key and credential information for future authentication.
The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type void otherwise.
*/
finishWebauthnUserRegistration(options: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: RegistrationFinishRequest & CustomRequestBody;
}>, rawResponse?: T): Promise;
/**
* This is the second step of the OAuth 2.1 authorization code flow.
For a private client, an application is able to get an access token for the shopper through the back channel (a trusted server) by passing in the client credentials and the authorization code retrieved from the `authorize` endpoint.
For a guest user, get the shopper JWT access token and a refresh token. This is where a client application is able to get an access token for the guest user through the back channel (a trusted server) by passing in the client credentials.
For a public client using PKCE, an application passes a PKCE `code_verifier` that matches the `code_challenge` that was used to `authorize` the customer along with the authorization code.
When refreshing the access token with a private client ID and client secret, the refresh token is _not_ regenerated. However, when refreshing the access token with a public client ID, the refresh token is _always_ regenerated. The old refresh token is voided with every refresh call, so the refresh token on the client must be replaced to always store the new refresh token.
See the Body section for required parameters, including `grant_type` and others that depend on the value of `grant_type`.
**Important**: As of July 31, 2024**, SLAS requires the `channel_id` query parameter in token requests.
---
# Token Issuer Subject Construction & Constraints #
The Issuer Subject (`isb`) claim of the issued JWT is a composite string that
identifies the shopper session. It concatenates the identity origin (`uido`),
login ID (`upn`), display name (`uidn`), guest customer ID (`gcid`, 26 chars),
registered customer ID (`rcid`, 26 chars, when applicable), channel ID (`chid`),
and any flow-specific values (`tsob`, `taob`, `agent`, `login`, `sesb`) as
`key:value` pairs separated by `::`.
**Constraint:** the assembled `isb` must not exceed **256 characters**.
Exceeding this returns `400 BAD_REQUEST` with *"Issuer Subject length must be
less than 256 characters"*.
**Length calculation breakdown** (with `gcid`=26, `rcid`=26, `chid`≤100).
Overhead = key chars + each key's trailing `:` + `::` separators between pairs.
| Shape | Overhead | Fixed values | Remaining budget |
|---|---|---|---|
| Guest | 32 | gcid 26 + chid 100 = 126 | 98 |
| Registered | 39 | gcid 26 + rcid 26 + chid 100 = 152 | 65 |
| TSOB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(tsob) |
| TSOB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(tsob) |
| Pwdless | 47 | gcid 26 + rcid 26 + chid 100 = 152 | 57 - len(login) |
| SESB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(sesb) |
| SESB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(sesb) |
| TAOB guest | 47 | gcid 26 + chid 100 = 126 | 83 - len(taob + agent) |
| TAOB registered | 54 | gcid 26 + rcid 26 + chid 100 = 152 | 50 - len(taob + agent) |
**Worst case (TAOB registered):**
```
256 total
- 54 overhead
- 26 gcid
- 26 rcid
- 100 chid (allowed max)
----
50
Then if taob = ta_ext_on_behalf_of:
50 - 19 = 31
Meaning only 31 characters remain for uido + upn + uidn + agent.
```
**Practical caps per variable sub-claim:**
| Sub-claim | Description | Max length |
|---|---|---|
| `uido` | Identity origin | ~20 |
| `upn` | Login ID / email | ~80 |
| `uidn` | Display name (after `%3A` escaping) | ~60 |
| `tsob` / `taob` | Trusted-system / trusted-agent hint | ~21 |
| `agent` | Agent ID | ~32 |
| `login` | Passwordless literal (e.g. `pwdless`) | short |
| `sesb` | Session-bridge hint | short |
| `chid` | Channel ID | 100 |
**Notes:**
- **Identity Origin Variance** — `uido` is a static IDP-configuration string
(e.g. `ecom`, `google`, `Link_Brand_Production`). A longer origin reduces
the budget available for user-supplied inputs.
- **Double-Count Fallback** — if a shopper registers without a first and last
name, `uidn` is generated from the email (prefix as first name, domain as
last name), so the email is effectively counted **twice** (once as `upn`,
once as `uidn`). Long emails are the most common cause of overflow.
- Colons inside `uidn` are URL-encoded as `%3A`, which can further inflate
its length.
*
* If you would like to get a raw Response object use the other getAccessToken function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.refresh_token - The long-term token used to refresh the short term access token. Required only with a grant type of `refresh_token`.
* @param options.body.code - Authorization code from the OAuth 2.1 service received in the front channel that is used to get access tokens and refresh tokens. Required with a grant type of `authorization_code` and `session_bridge`.
* @param options.body.usid - The shopper\'s unique identifier, if known. If not provided, a new USID is generated.
* @param options.body.grant_type -
* @param options.body.redirect_uri - The redirect URI that was used when getting the authorization code. A variety of URI formats and wildcards for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs: - `http://localhost:3000/callback` - `https://example.com/callback` - `com.example.app:redirect_uri_path` - ` *.subdomain.topleveldomain.com`
* @param options.body.code_verifier - PKCE code verifier. Created by the client calling the `login` endpoint. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_verifier` is optional when using a private client id for the token request.
* @param options.body.client_id - The SLAS client ID. Required when the grant type is `authorization_code_pkce`.
* @param options.body.channel_id - The channel (B2C Commerce site) that the user is associated with. **Important: We strongly recommended using the channel_id query parameter because it will be required in the future. **NOTE - As of July 31, 2024**, SLAS will be requiring the `channel_id` query parameter in token requests.
* @param options.body.dnt - This is an optional parameter to set `Do Not Track` for the session. SLAS is making this available, but will not be used by B2C Commerce until after the 24.4 release. Values are: * `false` * `true` If not added the `dnt` value will default to `false`.
*
* @returns A promise of type TokenResponse.
*/
getAccessToken(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: getAccessTokenBodyType;
}>): Promise;
/**
* This is the second step of the OAuth 2.1 authorization code flow.
For a private client, an application is able to get an access token for the shopper through the back channel (a trusted server) by passing in the client credentials and the authorization code retrieved from the `authorize` endpoint.
For a guest user, get the shopper JWT access token and a refresh token. This is where a client application is able to get an access token for the guest user through the back channel (a trusted server) by passing in the client credentials.
For a public client using PKCE, an application passes a PKCE `code_verifier` that matches the `code_challenge` that was used to `authorize` the customer along with the authorization code.
When refreshing the access token with a private client ID and client secret, the refresh token is _not_ regenerated. However, when refreshing the access token with a public client ID, the refresh token is _always_ regenerated. The old refresh token is voided with every refresh call, so the refresh token on the client must be replaced to always store the new refresh token.
See the Body section for required parameters, including `grant_type` and others that depend on the value of `grant_type`.
**Important**: As of July 31, 2024**, SLAS requires the `channel_id` query parameter in token requests.
---
# Token Issuer Subject Construction & Constraints #
The Issuer Subject (`isb`) claim of the issued JWT is a composite string that
identifies the shopper session. It concatenates the identity origin (`uido`),
login ID (`upn`), display name (`uidn`), guest customer ID (`gcid`, 26 chars),
registered customer ID (`rcid`, 26 chars, when applicable), channel ID (`chid`),
and any flow-specific values (`tsob`, `taob`, `agent`, `login`, `sesb`) as
`key:value` pairs separated by `::`.
**Constraint:** the assembled `isb` must not exceed **256 characters**.
Exceeding this returns `400 BAD_REQUEST` with *"Issuer Subject length must be
less than 256 characters"*.
**Length calculation breakdown** (with `gcid`=26, `rcid`=26, `chid`≤100).
Overhead = key chars + each key's trailing `:` + `::` separators between pairs.
| Shape | Overhead | Fixed values | Remaining budget |
|---|---|---|---|
| Guest | 32 | gcid 26 + chid 100 = 126 | 98 |
| Registered | 39 | gcid 26 + rcid 26 + chid 100 = 152 | 65 |
| TSOB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(tsob) |
| TSOB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(tsob) |
| Pwdless | 47 | gcid 26 + rcid 26 + chid 100 = 152 | 57 - len(login) |
| SESB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(sesb) |
| SESB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(sesb) |
| TAOB guest | 47 | gcid 26 + chid 100 = 126 | 83 - len(taob + agent) |
| TAOB registered | 54 | gcid 26 + rcid 26 + chid 100 = 152 | 50 - len(taob + agent) |
**Worst case (TAOB registered):**
```
256 total
- 54 overhead
- 26 gcid
- 26 rcid
- 100 chid (allowed max)
----
50
Then if taob = ta_ext_on_behalf_of:
50 - 19 = 31
Meaning only 31 characters remain for uido + upn + uidn + agent.
```
**Practical caps per variable sub-claim:**
| Sub-claim | Description | Max length |
|---|---|---|
| `uido` | Identity origin | ~20 |
| `upn` | Login ID / email | ~80 |
| `uidn` | Display name (after `%3A` escaping) | ~60 |
| `tsob` / `taob` | Trusted-system / trusted-agent hint | ~21 |
| `agent` | Agent ID | ~32 |
| `login` | Passwordless literal (e.g. `pwdless`) | short |
| `sesb` | Session-bridge hint | short |
| `chid` | Channel ID | 100 |
**Notes:**
- **Identity Origin Variance** — `uido` is a static IDP-configuration string
(e.g. `ecom`, `google`, `Link_Brand_Production`). A longer origin reduces
the budget available for user-supplied inputs.
- **Double-Count Fallback** — if a shopper registers without a first and last
name, `uidn` is generated from the email (prefix as first name, domain as
last name), so the email is effectively counted **twice** (once as `upn`,
once as `uidn`). Long emails are the most common cause of overflow.
- Colons inside `uidn` are URL-encoded as `%3A`, which can further inflate
its length.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
* @param options.body - The data to send as the request body.
* @param options.body.refresh_token - The long-term token used to refresh the short term access token. Required only with a grant type of `refresh_token`.
* @param options.body.code - Authorization code from the OAuth 2.1 service received in the front channel that is used to get access tokens and refresh tokens. Required with a grant type of `authorization_code` and `session_bridge`.
* @param options.body.usid - The shopper\'s unique identifier, if known. If not provided, a new USID is generated.
* @param options.body.grant_type -
* @param options.body.redirect_uri - The redirect URI that was used when getting the authorization code. A variety of URI formats and wildcards for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs: - `http://localhost:3000/callback` - `https://example.com/callback` - `com.example.app:redirect_uri_path` - ` *.subdomain.topleveldomain.com`
* @param options.body.code_verifier - PKCE code verifier. Created by the client calling the `login` endpoint. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_verifier` is optional when using a private client id for the token request.
* @param options.body.client_id - The SLAS client ID. Required when the grant type is `authorization_code_pkce`.
* @param options.body.channel_id - The channel (B2C Commerce site) that the user is associated with. **Important: We strongly recommended using the channel_id query parameter because it will be required in the future. **NOTE - As of July 31, 2024**, SLAS will be requiring the `channel_id` query parameter in token requests.
* @param options.body.dnt - This is an optional parameter to set `Do Not Track` for the session. SLAS is making this available, but will not be used by B2C Commerce until after the 24.4 release. Values are: * `false` * `true` If not added the `dnt` value will default to `false`.
* @param rawResponse - Set to true to return entire Response object instead of DTO.
*
* @returns A promise of type Response if rawResponse is true, a promise of type TokenResponse otherwise.
*/
getAccessToken(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
body: getAccessTokenBodyType;
}>, rawResponse?: T): Promise;
/**
* The `/jwks` endpoint provides a JSON Web Key Set (JWKS) that includes current, past, and future public keys. These keys allow clients to validate the Shopper JSON Web Token (JWT) issued by SLAS, ensuring that no tampering with the token has occurred. Every SLAS JWT that is passed into SLAS, SCAPI, or OCAPI is always validated and is rejected if the signature validation does not match.
To optimize performance, the `/jwks` endpoint is limited to 25 calls per minute, so we recommended caching the JWKS keys and refresh them only when necessary, instead of making frequent requests. Typically, the JWKs endpoint can be used once per DAY.
For additional information on using JWKS, see https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-validate-jwt-with-jwks.html.
*
* If you would like to get a raw Response object use the other getJwksUri function.
*
* @param options - An object containing the options for this method.
* @param options.parameters - An object containing the parameters for this method.
* @param options.parameters.organizationId - An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).
* @param options.retrySettings - Retry options for the `node-retry` package
* @param options.fetchOptions - Fetch options for the `make-fetch-happen` package
* @param options.headers - An object literal of key value pairs of the headers to be sent with this request.
*
* @returns A promise of type object.
*/
getJwksUri(options?: RequireParametersUnlessAllAreOptional<{
parameters?: CompositeParameters<{
organizationId: string;
} & QueryParameters, CommonParameters>;
retrySettings?: OperationOptions;
fetchOptions?: RequestInit;
headers?: {
[key: string]: string;
};
}>): Promise