Get Trusted Agent Access Token

POST/organizations/{organizationId}/oauth2/trusted-agent/token

Use it in a workflow

Add a step and choose the Salesforce Commerce Cloud connector.
Pick the Get Trusted Agent Access Token action (under Auth (SLAS)).
Fill in the fields below, then reference the result from later steps as {{getTrustedAgentAccessToken.response.data}}.

Request

Path parameters

organizationIdstringrequired

An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f_ecom_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types).

Headers

_sfdc_client_authstring

"Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (`:`), like this: `clientId:clientSecret`. (Do not add the string `"Basic"`.) The `_sfdc_client_auth` header is only required when using a SLAS private client ID."

Authorizationstring

This is the `Bearer` token that is returned from Account Manager after the trusted agent on behalf of (TAOB) authorize call.

Request body

Enter the body as JSON in the step's Body field.

agent_idstring

The ID of the merchant. If passed in, the `agent_id` will be validated using the SUB claim in the response from Account Manager. This is an optional parameter unless the request is for a Trusted Agent on Behalf then `agent_id` is required.

client_idstringrequired

The SLAS public client ID or SLAS private client ID for use with trusted-system requests. The `client_id` is not needed if a using a SLAS private `client_id` and the `_sfdc_client_auth` header.

channel_idstringrequired

The channel (B2C Commerce site) that the user is associated with.

code_verifierstringrequired

PKCE code verifier. Created by the caller. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_verifier` is not needed if a using a SLAS private `client_id` and the `_sfdc_client_auth` header.

grant_typestringrequired

Grant Type

One ofauthorization_coderefresh_tokenclient_credentialsauthorization_code_pkcesession_bridge

login_idstringrequired

The ID is the shopper for trusted agent access. For TAOB Guest the `login_id` must be set to `Guest`.

idp_originstringrequired

The IDP that the user is associated with. For TAOB Guest the `idp_origin` parameter should be `slas`. If set to any other IDP origin a 400 Bad Request will be returned.

usidstring

The shopper's unique identifier, if known. If not provided, a new USID is generated.

dntstring

This is an optional parameter to set `Do Not Track` for the session. SLAS is making this available, but will not be used by B2C Commerce until after the 24.4 release. Values are: * `false` * `true` If not added the `dnt` value will default to `true` Note: The default value for `dnt` is set to `true` for all TAOB flows. This is opposite from other SLAS token requests.

statestring

This is an optional parameter to set state for the trusted agent session. If the `state` parameter is used it will be validated and a 400 Bad Request will be returned if missing or invalid. For TAOB Guest you must pass the `state` parameter to transfer the state from the TAOB Guest authorization call to the token call. The `state` parameter value is returned with the authorization code in the response url from the TAOB guest authorization call, for example: `.../taob/callback?code=HETXpvg5LKBNIHjDTWkRrf2MLVU&state=taob.gst.7bc7fb7f-e646-44fd-bc73-dfd5c3c9019b`. You would use `taob.gst.7bc7fb7f-e646-44fd-bc73-dfd5c3c9019b` for the `state` value in the TAOB request.

json

{
  "client_id": "6c388ebd-6843-4863-aef9-781382c9e8cd",
  "channel_id": "RefArch",
  "code_verifier": "Ar0lAwU_jsuA~ZXX8-JnMbZFxrnDot2OtgLEi1kOT_FxD6Bo0EQDbbrvoym9xHvatNGnNzrObLJeK6e4U9m4pveRMbdwNGa4jwiAlKGvijVn0PW0hqb03_w1gQE00wTo",
  "grant_type": "authorization_code",
  "login_id": "jack.shopper@example.com",
  "idp_origin": "ecom",
  "agent_id": "merchant@example.com",
  "usid": "54ad2c5a-91f0-44ab-817c-73d6b86872d9",
  "dnt": "true",
  "state": "taobgst.3ebdcbb6-ef87-4f41-8173-67728636e513"
}

Response

Returns 200 with an object. Read it in later steps with {{getTrustedAgentAccessToken.response.data.<field>}}.

access_tokenstring

Short term shopper JWT that can be used to access Shopper APIs. Valid for 30 minutes. A trusted agent shopper JWT is valid for 15 min.

id_tokenstring

User ID token. Valid for 30 minutes.

refresh_tokenstring

Long term refresh token that can be used to refresh an access token. Valid for 30 days. The refresh_token will not be returned for trusted agents JWTs. A JWT for trusted agents expires after 15 minutes and is not refreshable. When expired, then app must restart the authorization flow and make another request to the /trusted-agent/authorize endpoint.

expires_ininteger

Remaining access token expiry time, in seconds.

refresh_token_expires_innumber

Remaining refresh token expiry time, in seconds.

token_typestring

Token Type

One ofBearer

usidstring

The unique shopper ID. Returned when using the `client_credentials` grant type.

customer_idstring

Customer's ID

enc_user_idstring

MD5 Hashed B2C Commerce user ID in uppercase.

idp_access_tokenstring

This is the access token that is returned from the IDP. The IDP access token is returned to be able to make calls into the IDP outside of SLAS.

idp_refresh_tokenstring

This is the refresh token that is returned from the IDP. The IDP refresh token is returned to be able to make calls into the IDP outside of SLAS.

dntstring

Do not track

json

{
  "access_token": "eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiSjIuMS4wIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJjb3JlL2Rldi9idGluZ2V5bHRtMiIsImF1dCI6IkdVSUQiLCJzdWIiOiJ1c2lkOjo1NGFkMmM1YS05MWYwLTQ0YWItODE3Yy03M2Q2Yjg2ODcyZDk6OnVwbjpndWVzdCIsIm5iZiI6MTU4Mjg0NTYyNCwiY3R4Ijoic2ZkYy5jb21tZXJjZWNsb3VkIiwiaXNzIjoiY29yZS9kZXYvYnRpbmdleWx0bTIiLCJzdHkiOiJVc2VyIiwiaXN0IjoxLCJleHAiOjE1ODI4NDU3NDQsImlhdCI6MTU4Mjg0NTY1NCwianRpIjoiQzJDOTA0ODg2NDA3MDkwNDg4NjQwNzMyMjExNzQ1ODEyMTQzIn0.2a6lMBSY17PrhDO8pvEk7PCXW_nkguMHi4J-Tuirkz-ETB6rnKyuRjF5yD6B55tMvm8dO8ulAHyDYqjObMxLJg",
  "id_token": "eyJraWQiOiI3NGU2YjMxZS1lYTczLTQ3OTYtOWRkYi1jMDJmZGI4ZDgwYmUiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2lkOmQ1MDBhMzY5LTc1MWQtNDkzYy1iNDAzLThmOThmYjg3MTdiNiIsImF1ZCI6IjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3YiIsImlzcyI6ImRldi51cy5zaG9wcGVyLmNjLnNhbGVzZm9yY2UuY29tIiwibmFtZSI6ImJsYWlyLnNsYXMudGVzdEBnbWFpbC5jb20iLCJleHAiOjE1OTExMTE0MzgsImlhdCI6MTU5MTEwOTYzOCwiZW1haWwiOiJibGFpci5zbGFzLnRlc3RAZ21haWwuY29tIn0.KgpAcq-G9Lz7IGnjkJlaFLFXYncVCwcVrRIuy3bEfgzRozqaDRvAori4oOz4RtgYjmoc5x2euoisHL0mVnHgPKOdYBty1wTJqneJEQt6hP4Kp0KFciID_ILCi-DE8VWS5t0NknnMP_iKhIkqcRL48iwPFUWkWA6AEWxE_yvJLNRLithsSxsx7EfBfpD8Hr2b5tMEwImQNmJNYGRTI4LSmcYspBORvJoAnfGpMC0kglxl40bhf5j4ItX4_DiWQC4zaGYD-HJV4BDr6C7iGCs5ZVPypF0yQD3iBio26fwj9Ys5WF9XMtPtqET2kqsz6fDC5GkE6HTUHH_r87jxbDq-8w",
  "refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU",
  "expires_in": 900,
  "refresh_token_expires_in": 2592000,
  "token_type": "Bearer",
  "usid": "18cda486-fe32-4e27-888b-6e4f89938e67",
  "customer_id": 1000005,
  "enc_user_id": "45D39A8499A95288F82855427EBA99B5",
  "idp_access_token": "eyJraWQiOiJYS21HbHVuSm0zSlBTMHNjQXZXV19XQlYtRi1wMkxLSDR0V05UMHVVSjVJIiwiYWxnIjoiUlMyNTYifQ.eyJ2ZXIiOjEsImp0aSI6IkFULjFMY0xxTWhqM2t0N1FKeFhxQ0VtdGZOOVV2eUcweW1meDFxZG9BdzF1NWMub2FyeXhveHF0QUtxaVFMbkM1ZDYiLCJpc3MiOiJodHRwczovL2Rldi05NTY1MjM2Lm9rdGEuY29tIiwiYXVkIjoiaHR0cHM6Ly9kZXYtOTU2NTIzNi5va3RhLmNvbSIsInN1YiI6Im9rdGEuc2xhcy50ZXN0IiwiaWF0IjoxNjc5Njk4MzA4LCJleHAiOjE2Nzk3MDE5MDgsImNpZCI6IjBvYTJrNXNma0JXZ0poTEVHNWQ2IiwidWlkIjoiMDB1MzhxZGpuU2NMT0IxbXE1ZDYiLCJzY3AiOlsib2ZmbGluZV9hY2Nlc3MiLCJvcGVuaWQiLCJlbWFpbCIsInByb2ZpbGUiXSwiYXV0aF90aW1lIjoxNjc5Njk4MzA2fQ.FDbGsnZGwTYVKGSlAo6jqcjG2HQ_BqQKRk72M5h69DRHyOM4wngsEELN_Wtgj3E77sP7IOmIKjiK5SFP17ADMbKZptVr2pqaMVF3PuU3Cbl_MgXZValfT-z12jHRq9sHMfsdTjY2RnvG44ZDFKc2no8mdL6IJ1MfCaZT5Tql5Ktq_UgudaWFsYqad3ETcmp5Y8ivz1bFnqud0sO9D9JzYOtfd9h71JKcsSC2rXc_Si-INPKKaGl8CDgaLXxu_Am9twJpUenHLpy0BerhcVvdFz7_611E53xOT_Esrc1pe-XAZtlYsJFnhxTBDT342ukiSWk2m6juVappv1GsRfUf2g",
  "idp_refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU",
  "dnt": true
}

Need more? See the Salesforce Commerce Cloud guide for connection setup and behaviour shared by every action.

Was this page helpful?