SLAS Commands

Commands for managing Shopper Login and API Access Service (SLAS) clients. For client types, user roles, and shopper authentication flows, see Salesforce's Authorization for Shopper APIs.

Global SLAS Flags

These flags are available on all SLAS commands:

Flag	Environment Variable	Description
`--tenant-id`	`SFCC_TENANT_ID`	(Required) SLAS tenant ID (organization ID)

Authentication

SLAS commands work out of the box using the CLI's built-in public client, which authenticates via browser login (Authorization Code + PKCE flow). No API client configuration is required for interactive use.

For automation or CI/CD, you can provide your own API client credentials.

Required Roles

Auth Method	Role	Configured On
Built-in client (default)	`SLAS Organization Administrator`	Your user account
User Authentication	`SLAS Organization Administrator`	Your user account
Client Credentials	`Sandbox API User`	The API client

The role must have a tenant filter configured for the organization you wish to manage.

Configuration

bash

# No configuration needed — opens browser for login
b2c slas client list --tenant-id abcd_123

# Or provide your own client ID
b2c slas client list --tenant-id abcd_123 --client-id xxx

# Client Credentials (for automation)
export SFCC_CLIENT_ID=my-client
export SFCC_CLIENT_SECRET=my-secret
b2c slas client list --tenant-id abcd_123

For complete setup instructions, see the Authentication Guide.

b2c slas token

Get a SLAS shopper access token for testing APIs.

Shopper authorization, login, and token requests use the shared HTTP middleware. Custom headers configured through SFCC_EXTRA_HEADERS (a JSON object) or --extra-headers apply to every step of both guest and registered flows. Use --log-level debug to include SLAS response correlation IDs when diagnosing failures.

Usage

bash

b2c slas token --tenant-id <TENANT_ID> --site-id <SITE_ID>

Flags

Flag	Environment Variable	Description	Required
`--tenant-id`	`SFCC_TENANT_ID`	SLAS tenant ID (organization ID)	Yes
`--site-id`	`SFCC_SITE_ID`	Site/channel ID	Yes*
`--slas-client-id`	`SFCC_SLAS_CLIENT_ID`	SLAS client ID (auto-discovered if omitted)	No
`--slas-client-secret`	`SFCC_SLAS_CLIENT_SECRET`	SLAS client secret (omit for public clients)	No
`--short-code`	`SFCC_SHORTCODE`	SCAPI short code	Yes
`--redirect-uri`		Redirect URI	No
`--shopper-login`		Registered customer login	No
`--shopper-password`		Registered customer password (prompted interactively if omitted)	No

* --site-id can be auto-discovered from the SLAS client configuration when using auto-discovery.

Flows

The command automatically selects the appropriate authentication flow based on whether --shopper-login and --slas-client-secret are provided:

Scenario	Flow
Guest, no `--slas-client-secret`	Public client guest PKCE (`authorization_code_pkce`)
Guest, with `--slas-client-secret`	Private client `client_credentials`
Registered (`--shopper-login`), no secret	Registered login + PKCE (`authorization_code_pkce`)
Registered (`--shopper-login`), with secret	Registered login + PKCE, plus client-secret Basic auth
No `--slas-client-id`	Auto-discovers first public client via SLAS Admin API

Registered login uses PKCE on both public and private clients

The registered-customer flow is always PKCE-protected: the /oauth2/login step presents a code_challenge, so the token exchange always sends the matching code_verifier. A private SLAS client additionally authenticates with its secret (HTTP Basic). This is why the registered flow works against both public and private clients.

Examples

bash

# Guest token with auto-discovery (finds first public SLAS client)
b2c slas token --tenant-id abcd_123 --site-id RefArch

# Guest token with explicit public client (PKCE flow)
b2c slas token --slas-client-id my-client \
  --tenant-id abcd_123 --short-code kv7kzm78 --site-id RefArch

# Guest token with private client (client_credentials flow)
b2c slas token --slas-client-id my-client --slas-client-secret sk_xxx \
  --tenant-id abcd_123 --short-code kv7kzm78 --site-id RefArch

# Registered customer token
b2c slas token --tenant-id abcd_123 --site-id RefArch \
  --shopper-login user@example.com --shopper-password secret

# JSON output (includes refresh token, expiry, usid, etc.)
b2c slas token --tenant-id abcd_123 --site-id RefArch --json

# Use token in a subsequent API call
TOKEN=$(b2c slas token --tenant-id abcd_123 --site-id RefArch)
curl -H "Authorization: Bearer $TOKEN" \
  "https://kv7kzm78.api.commercecloud.salesforce.com/..."

Output

Normal mode: prints the raw access token to stdout (pipeable)
JSON mode (--json): returns full token details:

json

{
  "response": {
    "accessToken": "...",
    "refreshToken": "...",
    "expiresIn": 1800,
    "tokenType": "Bearer",
    "usid": "...",
    "customerId": "..."
  },
  "clientId": "...",
  "siteId": "RefArch",
  "isGuest": true
}

Configuration

These values can also be set in dw.json:

json

{
  "tenant-id": "abcd_123",
  "short-code": "kv7kzm78",
  "slas-client-id": "my-public-client",
  "site-id": "RefArch"
}

Existing Client Selection

The get, update, delete, and open commands use the configured slasClientId when their positional CLIENTID is omitted. The value can come from dw.json, SFCC_SLAS_CLIENT_ID, --slas-client-id, the active instance, or a configuration plugin. A positional CLIENTID takes precedence over every configured source.

b2c slas client list

List SLAS clients for a tenant.

Usage

bash

b2c slas client list --tenant-id <TENANT_ID>

Flags

Flag	Description	Required
`--tenant-id`	SLAS tenant ID (organization ID)	Yes

Examples

bash

# List all SLAS clients for a tenant
b2c slas client list --tenant-id abcd_123

# Output as JSON
b2c slas client list --tenant-id abcd_123 --json

# Using environment variables
export SFCC_TENANT_ID=abcd_123
b2c slas client list

Output

Displays a list of SLAS clients with:

Client ID
Name
Type (public/private)
Channels

b2c slas client create

Create or update a SLAS client.

Usage

bash

b2c slas client create [CLIENTID] --tenant-id <TENANT_ID> --channels <CHANNELS> --redirect-uri <URI>

Arguments

Argument	Description	Required
`CLIENTID`	SLAS client ID (generates UUID if omitted)	No

Flags

Flag	Description	Default
`--tenant-id`	SLAS tenant ID (organization ID)	Required
`--channels`	Site IDs/channels (comma-separated)	Required
`--redirect-uri`	Redirect URIs (comma-separated)	Required
`--name`	Display name for the client	Auto-generated
`--scopes`	OAuth scopes for the client (comma-separated)
`--default-scopes`	Use default shopper scopes	`false`
`--callback-uri`	Callback URIs for passwordless login
`--secret`	Client secret (generated if omitted)	Auto-generated
`--public`	Create a public client (default is private)	`false`
`--[no-]create-tenant`	Automatically create tenant if it doesn't exist	`true`

Examples

bash

# Create a private client with specific scopes
b2c slas client create --tenant-id abcd_123 \
  --channels RefArch \
  --scopes sfcc.shopper-products,sfcc.shopper-search \
  --redirect-uri http://localhost:3000/callback

# Create a named client with custom ID
b2c slas client create my-client-id --tenant-id abcd_123 \
  --name "My Application" \
  --channels RefArch \
  --scopes sfcc.shopper-products \
  --redirect-uri http://localhost:3000/callback

# Create a public client
b2c slas client create --tenant-id abcd_123 \
  --channels RefArch \
  --default-scopes \
  --redirect-uri http://localhost:3000/callback \
  --public

# Output as JSON (useful for capturing the generated secret)
b2c slas client create --tenant-id abcd_123 \
  --channels RefArch \
  --default-scopes \
  --redirect-uri http://localhost:3000/callback \
  --json

Notes

If --secret is not provided for a private client, one will be generated
The generated secret is only shown once during creation
Use --default-scopes for common shopper API access scopes
By default, the tenant is automatically created if it doesn't exist. Use --no-create-tenant to disable this behavior if you prefer to manage tenants separately

b2c slas client get

Get details of a SLAS client.

Usage

bash

b2c slas client get [CLIENTID] --tenant-id <TENANT_ID>

Arguments

Argument	Description	Required
`CLIENTID`	SLAS client ID to retrieve. Defaults to the configured `slasClientId`	No

Examples

bash

# Get details for the configured SLAS client
b2c slas client get --tenant-id abcd_123

# Override the configured SLAS client ID
b2c slas client get my-client-id --tenant-id abcd_123

# Output as JSON
b2c slas client get my-client-id --tenant-id abcd_123 --json

Output

Displays detailed information about the client including:

Client ID and name
Type (public/private)
Channels
Scopes
Redirect URIs
Callback URIs

b2c slas client update

Update an existing SLAS client.

Usage

bash

b2c slas client update [CLIENTID] --tenant-id <TENANT_ID> [FLAGS]

Arguments

Argument	Description	Required
`CLIENTID`	SLAS client ID to update. Defaults to the configured `slasClientId`	No

Flags

Flag	Description
`--tenant-id`	(Required) SLAS tenant ID
`--name`	Update display name
`--secret`	Rotate client secret
`--channels`	Update channels (comma-separated)
`--scopes`	Update scopes (comma-separated)
`--redirect-uri`	Update redirect URIs (comma-separated)
`--callback-uri`	Update callback URIs (comma-separated)
`--replace`	Replace list values instead of appending

Examples

bash

# Update the configured client name
b2c slas client update --tenant-id abcd_123 --name "New Name"

# Override the configured SLAS client ID
b2c slas client update my-client-id --tenant-id abcd_123 --name "New Name"

# Rotate client secret
b2c slas client update my-client-id --tenant-id abcd_123 --secret new-secret-value

# Add scopes (appends to existing)
b2c slas client update my-client-id --tenant-id abcd_123 --scopes sfcc.shopper-baskets

# Replace all scopes
b2c slas client update my-client-id --tenant-id abcd_123 \
  --scopes sfcc.shopper-products,sfcc.shopper-baskets \
  --replace

# Replace all channels
b2c slas client update my-client-id --tenant-id abcd_123 \
  --channels RefArch,SiteGenesis \
  --replace

Notes

By default, list values (channels, scopes, URIs) are appended to existing values
Use --replace to replace all values instead of appending
Secret rotation takes effect immediately

b2c slas client delete

Delete a SLAS client.

Usage

bash

b2c slas client delete [CLIENTID] --tenant-id <TENANT_ID>

Arguments

Argument	Description	Required
`CLIENTID`	SLAS client ID to delete. Defaults to the configured `slasClientId`	No

Examples

bash

# Delete the configured client
b2c slas client delete --tenant-id abcd_123

# Override the configured SLAS client ID
b2c slas client delete my-client-id --tenant-id abcd_123

# Output as JSON
b2c slas client delete my-client-id --tenant-id abcd_123 --json

Notes

Deletion is permanent and cannot be undone
Active sessions using this client will be invalidated

b2c slas client open

Open the SLAS Admin UI for a client in your browser.

Usage

bash

b2c slas client open [CLIENTID] --tenant-id <TENANT_ID>

Arguments

Argument	Description	Required
`CLIENTID`	SLAS client ID to open in the admin UI. Defaults to the configured `slasClientId`	No

Flags

Flag	Environment Variable	Description	Required
`--tenant-id`	`SFCC_TENANT_ID`	SLAS tenant ID (organization ID)	Yes
`--short-code`	`SFCC_SHORTCODE`	SCAPI short code	Yes*
`--slas-client-id`	`SFCC_SLAS_CLIENT_ID`	Configured SLAS client ID	No

* --short-code can be set via SFCC_SHORTCODE environment variable or short-code in dw.json.

Examples

bash

# Open the SLAS Admin UI for the configured client
b2c slas client open --tenant-id abcd_123

# Override the configured SLAS client ID
b2c slas client open my-client-id --tenant-id abcd_123

# With explicit short code
b2c slas client open my-client-id --tenant-id abcd_123 --short-code kv7kzm78

Notes

Opens the SLAS Admin UI in your default browser
The URL is also printed to the console if the browser fails to open

SLAS Commands ​

Global SLAS Flags ​

Authentication ​

Required Roles ​

Configuration ​

b2c slas token ​

Usage ​

Flags ​

Flows ​

Examples ​

Output ​

Configuration ​

Existing Client Selection ​

b2c slas client list ​

Usage ​

Flags ​

Examples ​

Output ​

b2c slas client create ​

Usage ​

Arguments ​

Flags ​

Examples ​

Notes ​

b2c slas client get ​

Usage ​

Arguments ​

Examples ​

Output ​

b2c slas client update ​

Usage ​

Arguments ​

Flags ​

Examples ​

Notes ​

b2c slas client delete ​

Usage ​

Arguments ​

Examples ​

Notes ​

b2c slas client open ​

Usage ​

Arguments ​

Flags ​

Examples ​

Notes ​

SLAS Commands

Global SLAS Flags

Authentication

Required Roles

Configuration

b2c slas token

Usage

Flags

Flows

Examples

Output

Configuration

Existing Client Selection

b2c slas client list

Usage

Flags

Examples

Output

b2c slas client create

Usage

Arguments

Flags

Examples

Notes

b2c slas client get

Usage

Arguments

Examples

Output

b2c slas client update

Usage

Arguments

Flags

Examples

Notes

b2c slas client delete

Usage

Arguments

Examples

Notes

b2c slas client open

Usage

Arguments

Flags

Examples

Notes