# Authorization

Authorization for the B2C Commerce API resources is handled not through user permissions, but through *client* permissions.

A client for the B2C Commerce API can take many forms: anything from an online storefront to custom merchandising tools.

To authorize this wide range of client types, we’ve defined a set of scopes based on the OAuth 2.1 standard. The [available scopes](/docs/commerce/b2c-commerce/guide/auth-z-scope-catalog.md) give you control over exactly what clients are authorized to do with the SCAPI Admin APIs and Shopper APIs.

:::important
Not all endpoints use the same security scheme for authorization. Always check the Security section of the endpoint documentation, which is hidden by default.
:::

## Access Tokens

Both the Admin and Shopper APIs are authorized using an access token in the form of a [JSON Web Token](https://en.wikipedia.org/wiki/JSON_Web_Token) (JWT).

Using JWTs offers the following benefits:

- Coarse-grained client permissions with read-only and read-write permissions.
- Allows you to grant the same permissions for multiple B2C Commerce instances.
- Standardized, mature, and established technology.

The JWT access tokens for both SCAPI Admin APIs and Shopper APIs are included in your API requests as an HTTP header that follows the [Bearer authentication scheme](https://swagger.io/docs/specification/authentication/bearer-authentication/).

:::important
The SCAPI Admin APIs and Shopper APIs each have their own mechanisms for setting up API clients and requesting access tokens.
:::

## Quick Path to a Token

| I need a...           | Fastest path                                                                                                                                                                                       |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Shopper API token** | Create a SLAS client ([guide](/docs/commerce/b2c-commerce/guide/authorization-for-shopper-apis.md)), then call the `/token` endpoint ([SLAS overview](/docs/commerce/b2c-commerce/guide/slas.md)). |
| **Admin API token**   | Create an API client in Account Manager ([guide](/docs/commerce/b2c-commerce/guide/authorization-for-admin-apis.md)), then POST to `oauth2/access_token`.                                          |

For a runnable example that fetches a token and calls an endpoint, see [Make Your First Request](/docs/commerce/b2c-commerce/guide/scapi-get-started.md#make-your-first-request).

## Next Steps

- To set up SCAPI Admin API access, see the [Authorization for Admin APIs](/docs/commerce/b2c-commerce/guide/authorization-for-admin-apis.md) guide.
- To set up Shopper API access, see the [Authorization for Shopper APIs](/docs/commerce/b2c-commerce/guide/authorization-for-shopper-apis.md) guide.
- For advanced SLAS topics (grant types, token types, refresh tokens), see the [SLAS overview](/docs/commerce/b2c-commerce/guide/slas.md).
- Review the complete [Authorization Scopes Catalog](/docs/commerce/b2c-commerce/guide/auth-z-scope-catalog.md).