Authorize Customer

An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).

The redirect for Account Manager to redirect to. A variety of URI formats and wildcard for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs: - `http://localhost:3000/callback` - `https://example.com/callback` - `com.example.app:redirect_uri_path` - ` *.subdomain.topleveldomain.com`

Must be `code`. Indicates that the caller wants an authorization code.

One ofcode

The SLAS public client ID or SLAS private client ID for use with trusted-agent requests. When using a private client ID a PKCE code challenge is not required.

One ofopenidoffline_accessemail

Value to send the client to determine the state between the authorization request and the server response. Optional, but strongly recommended.

A unique shopper identifier (USID). If not provided, a new USID is generated.

Name of an identity provider (IDP) to optionally redirect to, thereby skipping the IDP selection step. To use a public client, set `hint` to `guest` and use a public client ID to get an authorization code. If no `hint` is provided, the preferred IDP of the tenant is used by default. For session bridge authorization the `hint` should be set to `sb-user` for a registered customer and to `sb-guest` for a guest. For session bridge authorization the SLAS Client `sfcc.session_bridge` scope.

The channel that this request is for. For a B2C Commerce request, this is angalous to the site ID.

PKCE code challenge. Created by the caller. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The *`code_challenge` and 'code_verifier'* are required if a using SLAS public `client_id`.

End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For example, the value `fr-CA fr en` represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). In most cases the IDP supports one language tag and has a default language set on the server. SLAS will support the space-separated list and pass them to the IDP.

Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (`:`). For example, `clientId:clientSecret`. Don't add the string `"Basic"`. The `x-slas-client-auth` header is supported for SLAS private clients. When strict client auth is enabled for the client, requests without this header are rejected with a 401.