# Checkout Session Authentication

Checkout Session APIs are authorized with the Shopper Login and API Access Service (SLAS). This page covers the SLAS private client and scope you need to call those APIs.

The **business profile** at `/.well-known/ucp` is unauthenticated. Configure and publish that profile in [Configuration and Discovery](/docs/commerce/b2c-commerce/guide/ucp-configuration.md).

- [Calling Checkout Session APIs](#calling-checkout-session-apis) — required scope and a dedicated SLAS private client
- [Create a SLAS Private Client](#create-a-slas-private-client)
- [Request an Access Token](#request-an-access-token)

## Calling Checkout Session APIs

`POST`, `GET`, and `PUT` on `/checkout-sessions`, plus `complete` and `cancel`, require a SLAS access token.

The required shopper scope is:

```
dev.ucp.shopping.checkout:manage
```

A token without that scope can't create, update, complete, or cancel a checkout session. Storefront SLAS clients typically don't include it, so create a **new SLAS private client** for UCP rather than reusing a public storefront client.

## Create a SLAS Private Client

Create the client in the SLAS Admin UI. Sign in with Account Manager credentials. You need the **SLAS Organization Administrator** role and the correct instance filters. The full role setup and client-creation steps are in [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-shopper-apis.md).

To access the SLAS Admin UI, replace `{short-code}` with the short code for your B2C Commerce instances:

```
https://{{short-code}}.api.commercecloud.salesforce.com/shopper/auth-admin/v1/ui/
```

Then:

1. Click **Clients**, and then click **Add Client**.
2. Select the tenant for the B2C Commerce instance.
3. Select **BFF or Web App** in **Which App Type will be used?** so SLAS creates a private client and generates a client secret.
4. In **Enter the shopper scopes**, include `dev.ucp.shopping.checkout:manage` (scopes are separated by a space if you add more than one).
5. Associate the client with the site (channel) you are enabling for UCP.
6. Copy the client ID and the generated secret. The secret is displayed only once.

:::important
Don't add shopper scopes such as `dev.ucp.shopping.checkout:manage` to an Account Manager API client. Shopper API scopes belong on SLAS clients. See [SLAS Clients](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.md#slas-clients).
:::

Alternatively, create the client with the SLAS Admin API or the B2C Commerce CLI (`b2c slas client create`). Those options are covered in [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-shopper-apis.md).

## Request an Access Token

For guest checkout—the usual way to call Checkout Session APIs from Postman or a similar tool—use the private-client **client credentials** grant. The numbered guest-user flow is in [Private SLAS Client Use Cases](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-private-client.md):

- Send an `Authorization` header with a Base64-encoded `client_id:client_secret` string.
- Set `grant_type=client_credentials`.
- Include `channel_id` set to your site ID. Guest `client_credentials` requests without `channel_id` fail.
- Request the scope `dev.ucp.shopping.checkout:manage`.

Send the returned access token as `Authorization: Bearer` on Checkout Session requests.