Loading
Salesforce Enforces New Security Requirements in Summer 2026Read More
Get Started with B2C Commerce
Configure SSO to a Salesforce IdP Sandbox Org

Configure SSO to a Salesforce IdP Sandbox Org

If the B2C instance connects to a Salesforce sandbox org: Create the External Client App in the production org, then configure the Auth Provider in the sandbox org. The Auth Provider uses the External Client App that you set up in the production org.

Important
Important The External Client App works only if you configure it in the Salesforce org that the Auth Provider uses as the IdP.

Create an External Client App at the Production Org

Configure an external client app in the production org that can communicate with the OAuth provider for the B2C Merchant Agent.

  1. Log in to your Salesforce org.
    Log in at login.salesforce.com or at your My Domain URL, if set up by your Salesforce admin, for example, https://company.my.salesforce.com.
  2. At the top of the page, click Setup and select Setup.
  3. In the Quick Find box, enter and select External Client App Manager.
  4. Click New External Client App.
  5. In the Basic Information tab, complete the required fields and set the distribution state to Local.
  6. Under API (Enable OAuth Settings), select Enable OAuth.
  7. For the Callback URL, enter https://login.salesforce.com/.
    After you create the Auth Provider in the sandbox org, copy its callback URL and replace the URL that you entered here.
  8. Select these OAuth scopes.
    • Access the Identity URL service (id, profile, email, address, phone)
    • Manage user data via APIs (api)
    • Perform requests at any time (refresh_token, offline_access)
    • Access unique user identifiers (openid)
  9. Leave all other settings at their default values.
  10. Click Create.

After the external client app is complete, the app provides a consumer key and consumer secret. Use these values to create the OAuth provider in the sandbox.

Configure the Auth Provider in the Sandbox Org

Before you begin, have the consumer key and secret generated by the external client available for the B2C Commerce Merchant Agent.

  1. In the Salesforce sandbox org, create the Registration Handler Apex Class.
    1. At the top of the page, click Setup and select Setup.
    2. In the Quick Find box, enter Apex Classes, and then select Apex Classes.
    3. Click New.
    4. Create the B2CRegistrationWrapper class by copying and pasting this code in the class editor.
      global class B2CRegistrationWrapper implements Auth.RegistrationHandler {
               /**
               * Instantiates the standard B2C Commerce handler to delegate the logic.
               */
               private Auth.B2CCommerceCloudRegistrationHandler getStandardHandler() {
               return new Auth.B2CCommerceCloudRegistrationHandler();
               }
               global User createUser(Id portalId, Auth.UserData data) {
               // You can add custom pre-processing logic here
               // Delegate to the standard handler
               return getStandardHandler().createUser(data);
               }
               global void updateUser(Id userId, Id portalId, Auth.UserData data) {
               // You can add custom logging or attribute mapping here
               // Delegate to the standard handler
               getStandardHandler().updateUser(userId, data);
               }
             }
  2. Save your changes.
    This Apex class acts as a wrapper around the standard B2C Commerce registration handler. You can add custom pre-processing logic or attribute mappings as needed.
  3. In the Quick Find box, enter Auth Providers, and then select Auth Providers.
  4. Click New.
  5. Configure the Auth Provider by entering the field values in the following table.
    Field Value
    Provider Type Salesforce
    Name Enter a descriptive name for the Auth Provider.
    Consumer Key From the Salesforce IdP org, go to the External Client App, select the Settings tab, and then locate the Consumer Key in OAuth Settings.
    Consumer Secret From the Salesforce IdP org, navigate to the External Client App, select the Settings tab, and then locate the Consumer Secret in OAuth Settings.
    Authorize Endpoint URL https://idp-org-hostname/services/oauth2/authorize
    Token Endpoint URL https://idp-org-hostname/services/oauth2/token
    Registration Handler Type Apex
    Registration Handler B2CRegistrationWrapper class
    Execute Registration As Select a user with the Salesforce admin role
  6. Click Save.
  7. Copy the generated Callback URL.
    The Auth Provider also generates a single sign-on URL for users to access the sandbox org.
  8. Log in to the primary IdP org and open the external client app that you created earlier.
  9. Paste the Callback URL into the external client app's Callback URL field.
  10. Save your changes.
 
Loading
Salesforce Help | Article