> This page is for Developer. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.bigcommerce.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server. # Get Storefront authToken for Specific Customer POST https://api-b2b.bigcommerce.com/api/io/auth/customers Content-Type: application/json Validates a Company user’s login credentials to create a storefront authToken that can be queried for future GraphQL requests. Equivalent Storefront GraphQL API Mutation: `login` The GraphQL API mutation also allows you to return a `storefrontLoginToken`. This retrieves a JWT, which can be passed to the BigCommerce [Customer Login endpoint](/developer/docs/storefront/guides/customer-authentication/customer-login) in order to log a customer in with a Stencil storefront session. The `login` response also includes information related to the Company user, such as their name and their account’s internal identifiers. **Note:** the resulting storefront authToken is tied to the Company user, and their assigned user role determines whether or not further requests are authorized. For example, if you generate an authToken for a user who does not have the `create_address` permission enabled, using the token to validate the GraphQL API `addressCreate` mutation will result in an error. For a complete list of Company user permissions and their scopes, see [Company Roles and Permissions](/developer/api-reference/rest/b2b/management/company/company-roles-and-permissions). ### Example GraphQL API Body **With Storefront authToken only** ```graphQL copy mutation { login( loginData: { storeHash: "1234abcd", email: "axe@snapmail.cc", password: "MyPassword123" } ) { result { token user { id bcId firstName lastName email } } } } ``` **With Storefront authToken and storefrontLoginToken** ```graphQL copy mutation { login( loginData: { storeHash: "1234abcd", email: "axe@snapmail.cc", password: "MyPassword123" } ) { result { token storefrontLoginToken user { id bcId firstName lastName email } } } } ``` ### Example GraphQL API Responses **With Storefront authToken only** ```json copy { "data": { "login": { "result": { "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6InRlc3RfYjJjX29yZGVyX2ltcG9ydEBxcS5jb21tIiwic3RvcmVfaGFzaCI6ImYyb3N4ampueGoiLCJkYiI6ImRlZmF1bHQifQ", "user": { "id": "8889911", "bcId": 28, "firstName": "B2B", "lastName": "User", "email": "user@example.com" } } } } } ``` **With Storefront authToken and storefrontLoginToken** ```json copy { "data": { "login": { "result": { "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6InRlc3RfYjJjX29yZGVyX2ltcG9ydEBxcS5jb21tIiwic3RvcmVfaGFzaCI6ImYyb3N4ampueGoiLCJkYiI6ImRlZmF1bHQifQ", "storefrontLoginToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImtpZG8yNzZAc25hcG1haWwuY2MiLCJzdG9yZV9oYXNoIjoiMWk2enB4cGUzZyIsImRiIjoiZGVmYXVsdCIsIm5hbWUiOiJ0ZXN0OSIsImNoYW5uZWxfaWRzIjpbMV0sInRva2VuX3R5cGUiOjMsIm5iZiI6MTAwMCwiZXhwIjoyMDAxfQ.EiR__LVAlBVNYtFCZPWJYoPv6UfGiXtULxhK-BCQZjY", "user": { "id": "8889911", "bcId": 28, "firstName": "B2B", "lastName": "User", "email": "user@example.com" } } } } } ``` Reference: https://docs.bigcommerce.com/developer/api-reference/rest/b2b/storefront/authentication/post-auth-customer ## Request ### Body (application/json) This endpoint expects an object. - `storeHash` (string, required) — The unique store hash for the BigCommerce store. - `channelId` (double, required, default: 1) — The storefront channel ID associated with the storefront login session. Use 1 for your store’s default storefront channel. - `name` (string, required) — The internal name assigned to the generated storefront authToken. - `email` (string, required) — The email address associated with the user's account. - `password` (string, required) — The password associated with the user's account. - `beginAt` (integer, optional) — The [Unix timestamp](https://www.unixtimestamp.com/) indicating when the storefront authToken starts being valid. - `endAt` (integer, optional) — The [Unix timestamp](https://www.unixtimestamp.com/) indicating when the storefront authToken is no longer valid. ## Response ### 200 OK - `code` (double, optional, default: 200) - `data` (IoAuthCustomersPostResponsesContentApplicationJsonSchemaData, optional) - `meta` (IoAuthCustomersPostResponsesContentApplicationJsonSchemaMeta, optional) ## Errors ### 400 Bad Request Error 400 - Auth Failed - `code` (double, optional) - `data` (IoAuthCustomersPostResponsesContentApplicationJsonSchemaData, optional) - `meta` (IoAuthCustomersPostResponsesContentApplicationJsonSchemaMeta, optional) ## Types ### IoAuthCustomersPostResponsesContentApplicationJsonSchemaData - `errMsg` (string, optional) ### IoAuthCustomersPostResponsesContentApplicationJsonSchemaMeta - `message` (string, optional) ## Examples **Request** ```json { "storeHash": "1234abcd", "channelId": 1000234, "name": "customer storefront token", "email": "user@example.com", "password": "MyPassword123" } ``` **Response** ```json { "code": 200, "data": { "name": "customer storefront token" }, "meta": { "message": "SUCCESS" } } ``` **SDK Code** ```python import requests url = "https://api-b2b.bigcommerce.com/api/io/auth/customers" payload = { "storeHash": "1234abcd", "channelId": 1000234, "name": "customer storefront token", "email": "user@example.com", "password": "MyPassword123" } headers = {"Content-Type": "application/json"} response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://api-b2b.bigcommerce.com/api/io/auth/customers'; const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"storeHash":"1234abcd","channelId":1000234,"name":"customer storefront token","email":"user@example.com","password":"MyPassword123"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api-b2b.bigcommerce.com/api/io/auth/customers" payload := strings.NewReader("{\n \"storeHash\": \"1234abcd\",\n \"channelId\": 1000234,\n \"name\": \"customer storefront token\",\n \"email\": \"user@example.com\",\n \"password\": \"MyPassword123\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api-b2b.bigcommerce.com/api/io/auth/customers") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Content-Type"] = 'application/json' request.body = "{\n \"storeHash\": \"1234abcd\",\n \"channelId\": 1000234,\n \"name\": \"customer storefront token\",\n \"email\": \"user@example.com\",\n \"password\": \"MyPassword123\"\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://api-b2b.bigcommerce.com/api/io/auth/customers") .header("Content-Type", "application/json") .body("{\n \"storeHash\": \"1234abcd\",\n \"channelId\": 1000234,\n \"name\": \"customer storefront token\",\n \"email\": \"user@example.com\",\n \"password\": \"MyPassword123\"\n}") .asString(); ``` ```php request('POST', 'https://api-b2b.bigcommerce.com/api/io/auth/customers', [ 'body' => '{ "storeHash": "1234abcd", "channelId": 1000234, "name": "customer storefront token", "email": "user@example.com", "password": "MyPassword123" }', 'headers' => [ 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api-b2b.bigcommerce.com/api/io/auth/customers"); var request = new RestRequest(Method.POST); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"storeHash\": \"1234abcd\",\n \"channelId\": 1000234,\n \"name\": \"customer storefront token\",\n \"email\": \"user@example.com\",\n \"password\": \"MyPassword123\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["Content-Type": "application/json"] let parameters = [ "storeHash": "1234abcd", "channelId": 1000234, "name": "customer storefront token", "email": "user@example.com", "password": "MyPassword123" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api-b2b.bigcommerce.com/api/io/auth/customers")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```