> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Get Server to Server Token

POST https://api-b2b.bigcommerce.com/api/io/auth/backend
Content-Type: application/json

Creates a Server to Server API account with a token to validate future requests made to B2B’s Server to Server APIs.

This endpoint does not require an existing API Account, but you must validate the request with the login credentials of your backend B2B Edition user account. Only users with the pre-built Administrator or Store Owner role are allowed to create API tokens with this endpoint; custom user roles with API account permissions are **not** supported.

> NOTE
> 
> This endpoint generates `authToken` API Accounts, which are considered deprecated as of September 30, 2025. It is recommended to use the BigCommerce API `X-Auth-Token` created in the control panel moving forward.

Reference: https://docs.bigcommerce.com/developer/api-reference/rest/b2b/management/authentication/post-auth-backend

## Authentication

- `X-Auth-Token` header (required) — | Header | Argument | Description | |:-------|:---------|:------------| | `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts). | For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts#x-auth-token-header-example-requests). For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes). For a list of API status codes, see [API Status Codes](/developer/api-reference/rest/overview#rest-http-status-codes).
- `X-Store-Hash` header (required) — | Header | Argument | Description | |:-------|:---------|:------------| | `X-Store-Hash` | `store_hash` | The unique store hash associated with a BigCommerce store that has B2B Edition enabled. |

## Request

### Body (application/json)

This endpoint expects an object.

- `storeHash` (string, required) — The unique store hash for the BigCommerce store.
- `email` (string, required) — The email address associated with the user's account.
- `password` (string, required) — The password associated with the user's account.
- `name` (string, required) — The internal name assigned to the generated API token.

## Response

### 200

OK

- `code` (integer, optional, default: 200) — The HTTP Status code of the response.
- `data` (list of AuthBackendPostResponsesContentApplicationJsonSchemaDataItems, optional)
- `meta` (AuthBackendPostResponsesContentApplicationJsonSchemaMeta, optional)

## Errors

### 400 Bad Request Error

BAD REQUEST

- `code` (integer, optional, default: 400) — The HTTP Status code of the response.
- `data` (AuthBackendPostResponsesContentApplicationJsonSchemaData, optional)
- `meta` (AuthBackendPostResponsesContentApplicationJsonSchemaMeta, optional)

## Types

### AuthBackendPostResponsesContentApplicationJsonSchemaDataItems

- `name` (string, optional) — The internal name assigned to the generated API token.
- `token` (string, optional)

### AuthBackendPostResponsesContentApplicationJsonSchemaMeta

- `message` (string, optional)

### AuthBackendPostResponsesContentApplicationJsonSchemaData

- `errMsg` (string, optional) — Message associated with the error.

## Examples

**Request**

```json
{
  "storeHash": "1234abcd",
  "email": "user@example.com",
  "password": "MyPassword123",
  "name": "customer storefront token"
}
```

**Response**

```json
{
  "code": 200,
  "data": [
    {
      "name": "customer storefront token",
      "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6InRlc3RfYjJjX29yZGVyX2ltcG9ydEBxcS5jb21tIiwic3RvcmVfaGFzaCI6ImYyb3N4ampueGoiLCJkYiI6ImRlZmF1bHQifQ.L_u_enljWoYBbPPskmYEQVHldHIaTcWMIB-SdFah850"
    }
  ],
  "meta": {
    "message": "SUCCESS"
  }
}
```

**SDK Code**

```python
import requests

url = "https://api-b2b.bigcommerce.com/api/io/auth/backend"

payload = {
    "storeHash": "1234abcd",
    "email": "user@example.com",
    "password": "MyPassword123",
    "name": "customer storefront token"
}
headers = {
    "X-Auth-Token": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api-b2b.bigcommerce.com/api/io/auth/backend';
const options = {
  method: 'POST',
  headers: {'X-Auth-Token': '<apiKey>', 'Content-Type': 'application/json'},
  body: '{"storeHash":"1234abcd","email":"user@example.com","password":"MyPassword123","name":"customer storefront token"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-b2b.bigcommerce.com/api/io/auth/backend"

	payload := strings.NewReader("{\n  \"storeHash\": \"1234abcd\",\n  \"email\": \"user@example.com\",\n  \"password\": \"MyPassword123\",\n  \"name\": \"customer storefront token\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Auth-Token", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api-b2b.bigcommerce.com/api/io/auth/backend")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Auth-Token"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"storeHash\": \"1234abcd\",\n  \"email\": \"user@example.com\",\n  \"password\": \"MyPassword123\",\n  \"name\": \"customer storefront token\"\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api-b2b.bigcommerce.com/api/io/auth/backend")
  .header("X-Auth-Token", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("{\n  \"storeHash\": \"1234abcd\",\n  \"email\": \"user@example.com\",\n  \"password\": \"MyPassword123\",\n  \"name\": \"customer storefront token\"\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api-b2b.bigcommerce.com/api/io/auth/backend', [
  'body' => '{
  "storeHash": "1234abcd",
  "email": "user@example.com",
  "password": "MyPassword123",
  "name": "customer storefront token"
}',
  'headers' => [
    'Content-Type' => 'application/json',
    'X-Auth-Token' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api-b2b.bigcommerce.com/api/io/auth/backend");
var request = new RestRequest(Method.POST);
request.AddHeader("X-Auth-Token", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"storeHash\": \"1234abcd\",\n  \"email\": \"user@example.com\",\n  \"password\": \"MyPassword123\",\n  \"name\": \"customer storefront token\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "X-Auth-Token": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [
  "storeHash": "1234abcd",
  "email": "user@example.com",
  "password": "MyPassword123",
  "name": "customer storefront token"
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api-b2b.bigcommerce.com/api/io/auth/backend")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```