Checkout Session Authentication

Checkout Session APIs are authorized with the Shopper Login and API Access Service (SLAS). This page covers the SLAS private client and scope you need to call those APIs.

The business profile at /.well-known/ucp is unauthenticated. Configure and publish that profile in Configuration and Discovery.

Calling Checkout Session APIs — required scope and a dedicated SLAS private client
Create a SLAS Private Client
Request an Access Token

Calling Checkout Session APIs

POST, GET, and PUT on /checkout-sessions, plus complete and cancel, require a SLAS access token.

The required shopper scope is:

1dev.ucp.shopping.checkout:manage

A token without that scope can’t create, update, complete, or cancel a checkout session. Storefront SLAS clients typically don’t include it, so create a new SLAS private client for UCP rather than reusing a public storefront client.

Create a SLAS Private Client

Create the client in the SLAS Admin UI. Sign in with Account Manager credentials. You need the SLAS Organization Administrator role and the correct instance filters. The full role setup and client-creation steps are in Authorization for Shopper APIs.

To access the SLAS Admin UI, replace {short-code} with the short code for your B2C Commerce instances:

1https://{{short-code}}.api.commercecloud.salesforce.com/shopper/auth-admin/v1/ui/

Then:

Click Clients, and then click Add Client.
Select the tenant for the B2C Commerce instance.
Select BFF or Web App in Which App Type will be used? so SLAS creates a private client and generates a client secret.
In Enter the shopper scopes, include dev.ucp.shopping.checkout:manage (scopes are separated by a space if you add more than one).
Associate the client with the site (channel) you are enabling for UCP.
Copy the client ID and the generated secret. The secret is displayed only once.

Don’t add shopper scopes such as dev.ucp.shopping.checkout:manage to an Account Manager API client. Shopper API scopes belong on SLAS clients. See SLAS Clients.

Important

Alternatively, create the client with the SLAS Admin API or the B2C Commerce CLI (b2c slas client create). Those options are covered in Authorization for Shopper APIs.

Request an Access Token

For guest checkout—the usual way to call Checkout Session APIs from Postman or a similar tool—use the private-client client credentials grant. The numbered guest-user flow is in Private SLAS Client Use Cases:

Send an Authorization header with a Base64-encoded client_id:client_secret string.
Set grant_type=client_credentials.
Include channel_id set to your site ID. Guest client_credentials requests without channel_id fail.
Request the scope dev.ucp.shopping.checkout:manage.

Send the returned access token as Authorization: Bearer on Checkout Session requests.