# Authorization for SCAPI Admin APIs

Learn how to create an API client in Account Manager and use the API client’s credentials to request an access token for the SCAPI Admin APIs.

:::important
- SCAPI Admin APIs are secured with Account Manager, but SCAPI Shopper APIs are secured with the Shopper Login and API Access Service (SLAS). This guide *only* covers how to access the SCAPI Admin APIs. To learn how to access the Shopper APIs, see [Authorization for Shopper APIs](/docs/commerce/b2c-commerce/guide/authorization-for-shopper-apis.md).
- Calls to SLAS Admin APIs require the role **Sandbox API User**.
- For the Account Manager API Client secret, only use alphanumeric passwords.
:::

## Before You Begin

Before you create your API client (or clients) for accessing the SCAPI Admin APIs, you must compile a list of OAuth scopes for each API family that you need to access. All the available scopes are listed in the [Authorization Scopes Catalog](/docs/commerce/b2c-commerce/guide/auth-z-scope-catalog.md).

To use CDN Zones, for example, add the following scopes to your list:

```text
sfcc.cdn-zones
sfcc.cdn-zones.rw
```

After you’ve compiled your list of scopes, come back to this guide and read on. Your list is needed when it comes time to populate the **Allowed Scopes** field in Account Manager.

## Create an API Client

To use the SCAPI Admin APIs, you (or someone with administrator access) must first create an API client by following these steps:

1. Log in to [Account Manager](https://account.demandware.com/).

2. Click **API Client** from the left navigation.

3. Click **Add API Client**.

4. In the **Display Name** field, enter unique and descriptive name for the API client. Example: Admin Client for Pia Larson.

5. In the **Password** field, enter a secure password.

6. In the **Confirm Password** field, reenter the password.

7. Save the password (also known as the client secret) in a password manager or other secure location.

8. Go to the **Organizations** section and do the following:
   1. Click **Add**.
   2. Select one or more organizations.
   3. Click **Add**.

9. Go to the **Roles** section and do the following:
   1. Click **Add**.
   2. Look for the **Salesforce Commerce API** category and select the `Salesforce Commerce API`.
   3. Click **Add**.
   4. Click the filter button.
   5. Select an organization.
   6. For each instance that you want to access with the API client:
      1. Select the instance.
      2. Click **Add**.

10. Go to the **OpenID Connect** section and do the following:

    1. In the **Default Scopes** field, enter the following scopes (on separate lines):

    ```text
    mail
    roles
    tenantFilter
    profile
    openId
    ```

    2. In the **Allowed Scopes** field, enter the list of scopes that you prepared earlier. Enter each scope on a separate line.

       :::important
       - Do not add shopper-related scopes to Account Manager clients.
       - Do not add data- or admin-related scopes to SLAS clients.
       - The previous actions cause token bloat and do not work as expected.
       :::
    3. For the **Token Endpoint Auth Method** field, select `client_secret_post`.
    4. For the **Access Token Format** field, select `JWT`.

11. In the **Redirect URIs** field, add `http://localhost:8080`.

12. Click **Save**.

13. Find your new API client in the table of API clients that appears after saving.

14. Copy the value in the **API Client ID** column of the table. Example: `1d763261-6522-4913-9d52-5d947d3b94c4`.

:::important
An API client that is used for the B2C Commerce API can’t be used with the [Open Commerce API](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/get-started-with-ocapi.md) (OCAPI), and vice versa. Each API framework (B2C Commerce API and OCAPI) requires its own API client. Also, an API client that is meant for OCAPI must not have the role “Salesforce Commerce API” assigned to it.
:::

## Request an Access Token

To request an access token for the SCAPI Admin APIs, make a request to Account Manager’s `oauth2` resource.

Get an access token with the [B2C CLI](/docs/commerce/b2c-commerce/guide/b2c-developer-tooling.md):

```bash
export SFCC_CLIENT_ID='your-account-manager-client-id'
export SFCC_CLIENT_SECRET='your-account-manager-client-secret'

npx @salesforce/b2c-cli auth token \
  --auth-scope sfcc.cdn-zones \
  --auth-scope SALESFORCE_COMMERCE_API:{realm}_{instance}
```

For a complete list of authentication CLI commands, see [Auth Commands](https://salesforcecommercecloud.github.io/b2c-developer-tooling/cli/auth.html).

:::note
In the examples provided, we’re using Unix shell commands to set environment variables to simplify the formation of the request. If you’re not using a Unix-based operating system, do the string replacement manually or use a tool like Postman to handle variable substitution.
:::

### Credentials String

In your request, you must provide a credentials string in the HTTP header that is composed of your client ID, followed by a colon (`:`), followed by your client secret (password). The `client_id` is a universally unique identifier (UUID) for the API client.

Use the following commands to format the credentials string correctly and save it as an environment variable.

Before running the following commands, replace the example client ID (`1d763261-6522-4913-9d52-5d947d3b94c4`) and example client secret (`GS8KmdDEUKfWnEnv`) with the credentials for the API client that you created earlier.

```bash
export "SFCC_OAUTH_CLIENT_ID=1d763261-6522-4913-9d52-5d947d3b94c4"
export "SFCC_OAUTH_CLIENT_SECRET=GS8KmdDEUKfWnEnv"
export "SFCC_CREDENTIALS=${SFCC_OAUTH_CLIENT_ID}:${SFCC_OAUTH_CLIENT_SECRET}"
```

### The Scope Parameter

Your request must also include additional information using the `scope` query parameter.

Although you can add roles for multiple instances to an API client, you can only request an access token for one instance at a time. To identify the instance that you want to associate with the access token, set its realm ID and instance ID as environment variables.

Before running the following commands, replace the example realm ID (`zzte`) and example instance ID (`053`) with the values for your B2C Commerce instance. (To learn how to look up these values, see the [Base URL and Request Formation](/docs/commerce/b2c-commerce/guide/base-url.md) guide.)

```bash
export "SFCC_REALM_ID=zzte"
export "SFCC_INSTANCE_ID=053"
```

There’s one more string you must include in the `scope` parameter: a space-separated list of requested scopes. The requested scopes are checked against the list allowed scopes that you configured earlier for the client ID.

For our example, we only need one scope (`sfcc.catalogs`). If you’re requesting multiple scopes, separate them with spaces.

```bash
export SFCC_OAUTH_SCOPES=sfcc.catalogs
```

:::important
If you include the `-rw` version for a scope, avoid using the read-only counterpart, as it is redundant. This applies to both Account Manager and SLAS client scopes, but is particularly important for SLAS shopper access calls, since SLAS provides all scopes in the token, and redundancy can make the token unnecessarily bulky.
:::

### HTTP Request

Now that you’ve collected all the strings for the `oauth2` endpoint, request an access token using an HTTP request like this:

```bash
curl "https://account.demandware.com/dwsso/oauth2/access_token" \
--request 'POST' \
--user "$SFCC_CREDENTIALS" \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data "grant_type=client_credentials" \
--data-urlencode "scope=SALESFORCE_COMMERCE_API:${SFCC_REALM_ID}_${SFCC_INSTANCE_ID} $SFCC_OAUTH_SCOPES"
```

If you’re not using environment variables, make sure to do the manual string replacement before running the `curl` command. Here’s what the same command looks like with example strings instead of environment variables:

```bash
curl "https://account.demandware.com/dwsso/oauth2/access_token" \
--request 'POST' \
--user "1d763261-6522-4913-9d52-5d947d3b94c4:GS8KmdDEUKfWnEnv" \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data "grant_type=client_credentials" \
--data-urlencode "scope=SALESFORCE_COMMERCE_API:zzte_053 sfcc.catalogs"
```

:::note
Note that only the `client_credentials` grant type is supported for accessing SCAPI Admin APIs.
:::

### Success Response

A successful request returns your access token as part of a JSON object:

```json
{
  "access_token": "eyJ0eXAiOiJKV1QiLCJraWQiOiJEMWhPUDdEODN4TjBqZWlqaTI3WWFvZFRjL0E9IiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiIxZDc2MzI2MS02NTIyLTQ5MTMtOWQ1Mi01ZDk0N2QzYjk0YzQiLCJjdHMiOiJPQVVUSDJfU1RBVEVMRVNTX0dSQU5UIiwiYXVkaXRUcmFja2luZ0lkIjoiZDBkZDk4MjItMmI3ZC00MThiLTkzZTktYzg2YjgxYjZjZGFhLTE2OTY2NTI3MSIsInN1Ym5hbWUiOiIxZDc2MzI2MS02NTIyLTQ5MTMtOWQ1Mi01ZDk0N2QzYjk0YzQiLCJpc3MiOiJodHRwczovL2FjY291bnQuZGVtYW5kd2FyZS5jb206NDQzL2R3c3NvL29hdXRoMiIsInRva2VuTmFtZSI6ImFjY2Vzc190b2tlbiIsInRva2VuX3R5cGUiOiJCZWFyZXIiLCJhdXRoR3JhbnRJZCI6IjcyWTZ0Slk1bm9vdEhMX2YzLWN5SzZrajVsOCIsImF1ZCI6IjFkNzYzMjYxLTY1MjItNDkxMy05ZDUyLTVkOTQ3ZDNiOTRjNCIsIm5iZiI6MTY1MTYyMjUzOCwiZ3JhbnRfdHlwZSI6ImNsaWVudF9jcmVkZW50aWFscyIsInNjb3BlIjpbIlNBTEVTRk9SQ0VfQ09NTUVSQ0VfQVBJOnp6dGVfMDUzIiwic2ZjYy5jYXRhbG9ncyIsIm1haWwiLCJ0ZW5hbnRGaWx0ZXIiLCJvcGVuSWQiLCJyb2xlcyJdLCJhdXRoX3RpbWUiOjE2NTE2MjI1MzgsInJlYWxtIjoiLyIsImV4cCI6MTY1MTYyNDMzOCwiaWF0IjoxNjUxNjIyNTM4LCJleHBpcmVzX2luIjoxODAwLCJqdGkiOiJlaXdlanNyWmxRdEpmMXhPZ0lJaVQ3REo2LTgiLCJjbGllbnRfaWQiOiIxZDc2MzI2MS02NTIyLTQ5MTMtOWQ1Mi01ZDk0N2QzYjk0YzQiLCJ0ZW5hbnRGaWx0ZXIiOiJTQUxFU0ZPUkNFX0NPTU1FUkNFX0FQSTp6enRlXzA1MyIsInJvbGVzIjpbIlNBTEVTRk9SQ0VfQ09NTUVSQ0VfQVBJIl19.N_D2gZuJfQcIo-X42O4i-hz1j4_KxYzaqYb4CqVSf96Zt9w5-WmDPP_swuIz2eCivxwrs0hyfKmDTS7mQG_fLXiuAr6FT0bMVYndfmSbngJl24eCXu2U6b5-cMlUmwAG7mO7Uji4_cXtayUCA9XGUSVXxu1HuiFzANws_D-cCWlgoaWpEvPmkhq3o_ICJvhcqaZTYDaoQ62hDToMqdojbRQFe6s2kDLiqOIi6Ey_VYev8bRTu4RtXmJ6Pfj_xp0mgc4ak8zaxCVcykZ-ziEE9TqO-tN1U6n0QnuTh-t3wz2iSyEcfJ3fOtv9v9zz1BYpe1qMCYDTkKnMq_alERtKZg",
  "scope": "SALESFORCE_COMMERCE_API:zzte_053 sfcc.catalogs mail tenantFilter openId roles",
  "token_type": "Bearer",
  "expires_in": 1799,
  "refresh_expires_in": 0,
  "not-before-policy": 0
}
```

With an access token from Account Manager (and the correct scopes), access any of the SCAPI Admin APIs, including: [Assignments](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=assignments\:Summary), [Catalogs](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=catalogs\:Summary), [Customers](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=customers\:Summary), [Inventory Availability](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=inventory-availability\:Summary), [Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=orders\:Summary), [Products](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=products\:Summary), and [8 more](https://developer.salesforce.com/docs/commerce/commerce-api/references).

## Next Steps

Now that you have set up your API client in Account Manager and know how to get an access token for SCAPI Admin APIs, it’s time to make some API requests!

Learn how to formulate your API requests with the last guide in the Get Started series: [Base URL and Request Formation](/docs/commerce/b2c-commerce/guide/base-url.md).

To learn how to access the Shopper APIs, see [Authorization for Shopper APIs](/docs/commerce/b2c-commerce/guide/authorization-for-shopper-apis.md).