Passwordless Login

Passwordless login is a way to verify a shopper’s identity without using a password. It offers protection against cyberattacks, such as phishing and brute-force password cracking. Passwordless login systems use authentication methods that are more secure than regular passwords, including one-time passwords (OTPs) and passkeys.

The Shopper Login and API Access Service (SLAS) supports multiple passwordless login methods:

• Passwordless Login with One-Time Passwords using Callback URI: Send an 8-digit, time-based OTP to your shopper for authentication. To use this method, you must have:
  • A publicly accessible callback URL, such as a B2C Commerce instance, Managed Runtime environment, or your own server.
  • A mechanism to share the passwordless token with the shopper, such as email or SMS.
  • A SLAS private client configured to work with passwordless login.

• Passwordless Login with SMS Service Provider: Send a verification code to shoppers via SMS. To use this method, you must have an SMS service provider such as Agentforce Marketing or Amazon SNS.
• Passwordless Login with Passkeys: Authenticate your shoppers using Fast IDentity Online 2 (FIDO2) credentials, also known as passkeys. To use this method, you must have a client-side implementation to serve as the interface for calling the browser’s WebAuthn API. SLAS private and public clients both support passkeys.
• Passwordless Login with Email: Send registered shoppers an OTP via email. To use this method, you must configure a SLAS private client to work with passwordless login. No third-party integration is required.

Select the passwordless authentication method that best fits your implementation requirements, infrastructure, and user experience goals.

Use this section to choose a SLAS passwordless pattern first, then confirm storefront-specific support in the feature support section and Storefront Next support pages.

For current storefront support and minimum-version requirements, use the Passwordless Login Feature Support section in this topic as the source of truth.

Choose OTP with Callback URI when:

• You need flexibility in OTP delivery channels (email, SMS, or custom)

  • If you already use Agentforce Marketing or Amazon SNS, you can use them to handle SMS OTP delivery with callback URI.

• You want to control the entire authentication flow

• You already have a notification infrastructure

Choose Passkeys when:

• You want the highest security level
• Your users expect biometric authentication
• You want to eliminate passwords entirely

Choose Email OTP when:

• You want the fastest implementation with no third-party dependencies
• Email delivery is sufficient for your use case
• You want to minimize infrastructure complexity

Headless storefront implementations can support all Passwordless Login features:

• Passwordless Login with One-Time Passwords using Callback URI
• Passwordless Login with Passkeys
• Passwordless Login with SMS Service Provider
• Passwordless Login with Email
• Register a Customer with Passwordless Login

Storefront Next has storefront-specific support constraints. To review feature availability, see:

• Login and Registration Support in Storefront Next
• Login and Registration Support for Hybrid Storefront Next Storefronts