> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Authentication

Plan: B2B Developer

Lesson 6 of 19 · 15 min

The B2B REST Management API facilitates admin-level management of all core B2B data, including  companies, users, addresses, quotes, invoices, and more.

B2B Edition endpoints are available at a different base URL than the standard BigCommerce REST Admin API:

`https://api-b2b.bigcommerce.com`

Despite this difference, authentication is handled with the same [store-level API tokens](/developer/docs/overview/api-fundamentals/api-accounts#store-level-api-accounts) that are used for all BigCommerce REST Admin API endpoints.

## Creating API Accounts in the Control Panel

Creating an account and token for the B2B REST API follows the same process that is used for all such accounts in the BigCommerce control panel.  This is handled within the "Store-level API accounts" section under Settings.

To create a valid API account, create an account with the type "V2/V3 API token" with the "modify B2B Edition" scope.

![The B2B Edition scope](/_fern-img/7d783d8a9fb4f3b82b95ba9af1d76c7bcf2fc98f5390392fd128e3ba393af75f.webp)

> **Info**
>
> Note that the "B2B Edition" scope will only be available for a store-level API account in stores where B2B Edition is enabled.

## Authentication Structure

As with all BigCommerce REST API requests, the token from your store-level API account should be passed in the `X-Auth-Token` header. In addition, include the `X-Store-Hash` header to identify your store.  (This contrasts with the standard BigCommerce REST Admin API, where the store is identified in the URL path of the endpoint.)

## Example Request:

```http showLineNumbers={false}
GET /api/v3/io/companies
Accept: application/json
Content-Type: application/json
X-Auth-Token: <access-token>
X-Store-Hash: <store-hash>
```

> **Info**
>
> ### Legacy B2B Edition API Accounts
>
> The B2B REST Management API previously utilized separate authentication tokens managed within B2B Edition.  If there are legacy tokens associated with your store, these can be reviewed in the API Accounts section within B2B Edition settings.
>
> These legacy tokens are used in REST requests with the `authToken` header instead of the `X-Auth-Token` header, and existing tokens will continue to function.  However, creation of these legacy tokens is deprecated.

## Resources

* [B2B Edition API Best Practices](/developer/docs/b2b-edition/getting-started/best-practices)
* [B2B Edition API Overview](/developer/docs/b2b-edition/getting-started/overview)
* [B2B Edition API Authentication](/developer/docs/b2b-edition/getting-started/authentication)
* [Store-Level API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#store-level-api-accounts)