---
editLink: false
lastUpdated: false
---

[@salesforce/b2c-tooling-sdk](../../modules.md) / [auth](../index.md) / resolveSystemOAuthStrategy

# Function: resolveSystemOAuthStrategy()

> **resolveSystemOAuthStrategy**(`credentials`, `methods`): [`AuthStrategy`](../interfaces/AuthStrategy.md) \| `undefined`

Defined in: [packages/b2c-tooling-sdk/src/auth/resolve.ts:277](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/1dedfc1ffefa01c3d5bff62c8f7e7e682a1a91cd/packages/b2c-tooling-sdk/src/auth/resolve.ts#L277)

Builds a stateless, scope-flexible **system** OAuth strategy — client-credentials
or JWT Bearer — or `undefined` when neither is fully configured.

These are the only flows that can request arbitrary `sfcc.*` scopes from Account
Manager per call (via the scope-cascade / additional-scopes hooks the SCAPI client
factories rely on). Browser user-auth (PKCE/implicit) and fixed-token stored
sessions are intentionally excluded, so this is the shared definition of
"SCAPI-eligible auth" used by both B2CInstance.scapiClientConfig and
`MrtCommand.getScapiMrtConfig`.

Unlike [resolveAuthStrategy](resolveAuthStrategy.md), this handles JWT (which needs cert/key paths
not present on [AuthCredentials](../interfaces/AuthCredentials.md)) and never throws — callers treat
`undefined` as "not SCAPI-eligible". The Account Manager host default is applied by
the strategy constructors, so `accountManagerHost` may be passed through as-is.

## Parameters

### credentials

[`SystemOAuthCredentials`](../interfaces/SystemOAuthCredentials.md)

The available system OAuth credentials.

### methods

[`AuthMethod`](../type-aliases/AuthMethod.md)[] = `...`

Allowed methods in priority order. Defaults to
  client-credentials before JWT, matching the CLI's auth priority.

## Returns

[`AuthStrategy`](../interfaces/AuthStrategy.md) \| `undefined`

The first eligible strategy, or `undefined` if none is configured.