Finish Webauthn Authentication

Finish WebAuthn authentication

POST/organizations/{organizationId}/oauth2/webauthn/authenticate/finish

Use it in a workflow

Add a step and choose the Salesforce Commerce Cloud connector.
Pick the Finish Webauthn Authentication action (under Auth (SLAS)).
Fill in the fields below, then reference the result from later steps as {{finishWebauthnAuthentication.response.data}}.

Request

Path parameters

organizationIdstringrequired

An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).

Headers

Authorizationstring

Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`). For example: `clientId:clientSecret`.

Request body

Enter the body as JSON in the step's Body field.

user_idstring

The ID of the user.

channel_idstringrequired

The ID of the channel.

client_idstringrequired

The ID of the OAuth client.

emailstring (email)

User's email address.

tenant_idstring

The ID of the tenant.

usidstring

The unique session ID.

credentialobjectrequired

WebAuthn credential representation. The response field can contain either AuthenticatorAttestationResponseJson (for registration) or AuthenticatorAssertionResponseJson (for authentication).

idstringrequired

Base64url-encoded credential ID

rawIdstringrequired

Base64url-encoded raw credential ID.

typestringrequired

The type of credential.

One ofpublic-key

clientExtensionResultsstring

WebAuthn client extension results (typically empty).

responseoneOfrequired

Authenticator response (attestation for registration, assertion for authentication)

json

{
  "channel_id": "RefArch",
  "client_id": "12345678-1234-1234-1234-123456789012",
  "credential": {
    "id": "AQIDBAUGBwgJCgsMDQ4PEA",
    "rawId": "AQIDBAUGBwgJCgsMDQ4PEA",
    "type": "public-key",
    "response": null,
    "clientExtensionResults": {
      "extensions": {}
    }
  },
  "user_id": "user@example.com",
  "email": "user@example.com",
  "tenant_id": "zzte_053",
  "usid": "87654321-4321-4321-4321-210987654321"
}

Response

Returns 200 with an object. Read it in later steps with {{finishWebauthnAuthentication.response.data.<field>}}.

credentialIdstring

The credential ID that was used for authentication.

usernamestring

The authenticated username.

successboolean

Specifies whether authentication was successful (true) or not (false).

tokenResponseobject

access_tokenstringrequired

Short term shopper JWT that can be used to access Shopper APIs. Valid for 30 minutes. A trusted agent shopper JWT is valid for 15 min.

id_tokenstringrequired

User ID token. Valid for 30 minutes.

refresh_tokenstringrequired

Long term refresh token that can be used to refresh an access token. Valid for 30 days. The refresh_token will not be returned for trusted agents JWTs. A JWT for trusted agents expires after 15 minutes and is not refreshable. When expired, then app must restart the authorization flow and make another request to the /trusted-agent/authorize endpoint.

expires_inintegerrequired

Remaining access token expiry time, in seconds.

refresh_token_expires_innumberrequired

Remaining refresh token expiry time, in seconds.

token_typestringrequired

Token Type

One ofBearer

usidstringrequired

The unique shopper ID. Returned when using the `client_credentials` grant type.

customer_idstringrequired

Customer's ID

enc_user_idstringrequired

MD5 Hashed B2C Commerce user ID in uppercase.

idp_access_tokenstringrequired

This is the access token that is returned from the IDP. The IDP access token is returned to be able to make calls into the IDP outside of SLAS.

idp_refresh_tokenstring

This is the refresh token that is returned from the IDP. The IDP refresh token is returned to be able to make calls into the IDP outside of SLAS.

dntstring

Do not track

json

{
  "credentialId": "AQIDBAUGBwgJCgsMDQ4PEA",
  "username": "user@example.com",
  "success": true,
  "tokenResponse": {
    "access_token": "eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiSjIuMS4wIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJjb3JlL2Rldi9idGluZ2V5bHRtMiIsImF1dCI6IkdVSUQiLCJzdWIiOiJ1c2lkOjo1NGFkMmM1YS05MWYwLTQ0YWItODE3Yy03M2Q2Yjg2ODcyZDk6OnVwbjpndWVzdCIsIm5iZiI6MTU4Mjg0NTYyNCwiY3R4Ijoic2ZkYy5jb21tZXJjZWNsb3VkIiwiaXNzIjoiY29yZS9kZXYvYnRpbmdleWx0bTIiLCJzdHkiOiJVc2VyIiwiaXN0IjoxLCJleHAiOjE1ODI4NDU3NDQsImlhdCI6MTU4Mjg0NTY1NCwianRpIjoiQzJDOTA0ODg2NDA3MDkwNDg4NjQwNzMyMjExNzQ1ODEyMTQzIn0.2a6lMBSY17PrhDO8pvEk7PCXW_nkguMHi4J-Tuirkz-ETB6rnKyuRjF5yD6B55tMvm8dO8ulAHyDYqjObMxLJg",
    "id_token": "eyJraWQiOiI3NGU2YjMxZS1lYTczLTQ3OTYtOWRkYi1jMDJmZGI4ZDgwYmUiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2lkOmQ1MDBhMzY5LTc1MWQtNDkzYy1iNDAzLThmOThmYjg3MTdiNiIsImF1ZCI6IjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3YiIsImlzcyI6ImRldi51cy5zaG9wcGVyLmNjLnNhbGVzZm9yY2UuY29tIiwibmFtZSI6ImJsYWlyLnNsYXMudGVzdEBnbWFpbC5jb20iLCJleHAiOjE1OTExMTE0MzgsImlhdCI6MTU5MTEwOTYzOCwiZW1haWwiOiJibGFpci5zbGFzLnRlc3RAZ21haWwuY29tIn0.KgpAcq-G9Lz7IGnjkJlaFLFXYncVCwcVrRIuy3bEfgzRozqaDRvAori4oOz4RtgYjmoc5x2euoisHL0mVnHgPKOdYBty1wTJqneJEQt6hP4Kp0KFciID_ILCi-DE8VWS5t0NknnMP_iKhIkqcRL48iwPFUWkWA6AEWxE_yvJLNRLithsSxsx7EfBfpD8Hr2b5tMEwImQNmJNYGRTI4LSmcYspBORvJoAnfGpMC0kglxl40bhf5j4ItX4_DiWQC4zaGYD-HJV4BDr6C7iGCs5ZVPypF0yQD3iBio26fwj9Ys5WF9XMtPtqET2kqsz6fDC5GkE6HTUHH_r87jxbDq-8w",
    "refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU",
    "expires_in": 900,
    "refresh_token_expires_in": 2592000,
    "token_type": "Bearer",
    "usid": "18cda486-fe32-4e27-888b-6e4f89938e67",
    "customer_id": 1000005,
    "enc_user_id": "45D39A8499A95288F82855427EBA99B5",
    "idp_access_token": "eyJraWQiOiJYS21HbHVuSm0zSlBTMHNjQXZXV19XQlYtRi1wMkxLSDR0V05UMHVVSjVJIiwiYWxnIjoiUlMyNTYifQ.eyJ2ZXIiOjEsImp0aSI6IkFULjFMY0xxTWhqM2t0N1FKeFhxQ0VtdGZOOVV2eUcweW1meDFxZG9BdzF1NWMub2FyeXhveHF0QUtxaVFMbkM1ZDYiLCJpc3MiOiJodHRwczovL2Rldi05NTY1MjM2Lm9rdGEuY29tIiwiYXVkIjoiaHR0cHM6Ly9kZXYtOTU2NTIzNi5va3RhLmNvbSIsInN1YiI6Im9rdGEuc2xhcy50ZXN0IiwiaWF0IjoxNjc5Njk4MzA4LCJleHAiOjE2Nzk3MDE5MDgsImNpZCI6IjBvYTJrNXNma0JXZ0poTEVHNWQ2IiwidWlkIjoiMDB1MzhxZGpuU2NMT0IxbXE1ZDYiLCJzY3AiOlsib2ZmbGluZV9hY2Nlc3MiLCJvcGVuaWQiLCJlbWFpbCIsInByb2ZpbGUiXSwiYXV0aF90aW1lIjoxNjc5Njk4MzA2fQ.FDbGsnZGwTYVKGSlAo6jqcjG2HQ_BqQKRk72M5h69DRHyOM4wngsEELN_Wtgj3E77sP7IOmIKjiK5SFP17ADMbKZptVr2pqaMVF3PuU3Cbl_MgXZValfT-z12jHRq9sHMfsdTjY2RnvG44ZDFKc2no8mdL6IJ1MfCaZT5Tql5Ktq_UgudaWFsYqad3ETcmp5Y8ivz1bFnqud0sO9D9JzYOtfd9h71JKcsSC2rXc_Si-INPKKaGl8CDgaLXxu_Am9twJpUenHLpy0BerhcVvdFz7_611E53xOT_Esrc1pe-XAZtlYsJFnhxTBDT342ukiSWk2m6juVappv1GsRfUf2g",
    "idp_refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU",
    "dnt": true
  }
}

Need more? See the Salesforce Commerce Cloud guide for connection setup and behaviour shared by every action.

Was this page helpful?