Skip to main content

Generate an Account Management Authentication Token

POST 
/v2/account-members/tokens

Commerce provides authentication tokens for anyone using the Account Management APIs, including accounts and account members.

For each element in the list returned by the account member authentication API, a token value is returned. In order for a shopper to authenticate as the account, this value should be set as the EP-Account-Management-Authentication-Token header when calling Commerce. This header grants access to additional resources associated with the account, such as carts, orders, catalogs with associated rules, and addresses.

The set of permissions available to a shopper using an Account Management Authentication token is documented in Permissions

Commerce provides authentication tokens for an account and an account member using:

  • OpenID Connect
  • Username and password
  • Self signup
  • One-time password token
  • Switch account token

Request​

Body

    data object required
    oneOf
    type stringrequired

    Default value: account_management_authentication_token

    Specifices the type of the object. You must use account_management_authentication_token.

    authentication_mechanism stringrequired

    Default value: oidc

    Species the authentication mechanism. You must use oidc.

    oauth_authorization_code stringrequired

    Specifies the code returned from the OpenID Connect Provider authentication.

    oauth_redirect_uri urirequired

    Specifies the URL of the front-end that handles the callback of the token.

    oauth_code_verifier stringrequired

    Specifies the Proof Key for Code Exchange (PKCE) code verifier corresponding to the code challenge supplied to the authorization endpoint. For more information about code verifier and challenge, see Generating a Code Verifier and Challenge.

Responses​

Created

Schema
    data AccountManagementAuthenticationTokenResponse[]
  • Array [
    • type string

    Default value: account_management_authentication_token

    Specifies the type of the object.

    account_name string

    The name of the account that this token grants access to.

    account_id uuid

    The ID of the account that this token grants access to.

    token string

    The JWT authentication token that the shopper uses as the EP-Account-Management-Authentication-Token header in all other endpoints.

    expires date-time

    The epoch time that this token expires at. The time is set to 24 hours after the token is generated.

  • ]
    • meta object
    page object
    limit integer

    The maximum number of records per page for this response. You can set this value up to 100.

    current integer

    The current page.

    offset integer

    The current offset by number of records, not pages. Offset is zero-based.

    total integer

    The total page count.

    results object
    total integer

    The total number of results after applying filters, if any, or all results.

    links object
    current uri

    Always the current page.

    first uri

    Always the first page.

    last uri

    Always null if there is only one page.

    next string

    Always null if there is only one page.

    prev string

    Always null if the user is on the first page.

Loading...