Passwordless Login | SCAPI | B2C Commerce Storefront Reference Architecture

Passwordless login is a way to verify a shopper’s identity without using a password. It offers protection against cyberattacks, such as phishing and brute-force password cracking. Passwordless login systems use authentication methods that are more secure than regular passwords, including one-time passwords (OTPs) and passkeys.

The Shopper Login and API Access Service (SLAS) supports multiple passwordless login methods:

Passwordless Login with One-Time Passwords using Callback URI: Send an 8-digit, time-based OTP to your shopper for authentication. To use this method, you must have:
- A publicly accessible callback URL, such as a B2C Commerce instance, Managed Runtime environment, or your own server.
- A mechanism to share the passwordless token with the shopper, such as email or SMS.
- A SLAS private client configured to work with passwordless login.

The OTP Callback URI method also supports shopper registration. See Register a Customer with Passwordless Login.

Note

Passwordless Login with SMS Service Provider: Send a verification code to shoppers via SMS. To use this method, you must have an SMS service provider such as Agentforce Marketing or Amazon SNS.
Passwordless Login with Passkeys: Authenticate your shoppers using Fast IDentity Online 2 (FIDO2) credentials, also known as passkeys. To use this method, you must have a client-side implementation to serve as the interface for calling the browser’s WebAuthn API. SLAS private and public clients both support passkeys.
Passwordless Login with Email: Send registered shoppers an OTP via email. To use this method, you must configure a SLAS private client to work with passwordless login. No third-party integration is required.

Choosing a Passwordless Method

Select the passwordless authentication method that best fits your implementation requirements, infrastructure, and user experience goals.

Use this section to choose a SLAS passwordless pattern first, then confirm storefront-specific support in the feature support section and Storefront Next support pages.

For current storefront support and minimum-version requirements, use the Passwordless Login Feature Support section in this topic as the source of truth.

Decision Guidance

Choose OTP with Callback URI when:

You need flexibility in OTP delivery channels (email, SMS, or custom)
- If you already use Agentforce Marketing or Amazon SNS, you can use them to handle SMS OTP delivery with callback URI.
You want to control the entire authentication flow
You already have a notification infrastructure

Choose Passkeys when:

You want the highest security level
Your users expect biometric authentication
You want to eliminate passwords entirely

Choose Email OTP when:

You want the fastest implementation with no third-party dependencies
Email delivery is sufficient for your use case
You want to minimize infrastructure complexity

Passwordless Login Feature Support

Headless storefront implementations can support all Passwordless Login features:

Storefront Next has storefront-specific support constraints. To review feature availability, see:

Passwordless Login isn’t supported for SFRA, SFRA with Hybrid Auth, or PWA Kit with Hybrid Auth.

Note