Standard User Authentication

This is simplest and most straightforward use case delivered by the Authenticate User Process. The Process consumes a valid authN ID and credential, and successfully authenticates the user. The Process then returns a successful response that indicates the user has been authenticated to Storefront Gateway, and can proceed to make requests to protected APIs.

Initial Request

The client calls the Session Start API to initialize the Process. The user’s credentials are included in the request body:

**REQUEST - POST https://\{your.url\}/session/start**
{
   "authnIdentifier": "jane.smith@example.ca",
   "credential": "5oodP@s$word321"
}

`authnIdentifier`	The user’s registered email address, mobile number, or alias (if any)
`credential`	The user’s password

Process Complete

If the user provides valid credentials, and no other authentication protocols are necessary (e.g., MFA) then the Process responds with an HTTP 200 status, and User details in the response body:

**RESPONSE - body**
{
   "processId": "eec918ff-5db4-4fee-a601-5ff76a099c8e",
   "lastStep": true,
   "runtimeId": 229,
   "userId": 12345,
   "userAuthenticated:" true
}

`processId`	The unique identifier for this instance of the Process.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
`runtimeId`	Identifier of the Storefront Gateway Runtime entity currently associated to the Storefront Gateway User entity.About Runtime Entities:Upon user creation or authentication, Storefront Gateway looks for a JRUNTIMEID cookie in the user’s browser or application. If no cookie is found, Storefront Gateway creates a Runtime Entity with a unique ID and associates it to the user during the login phase. Storefront Gateway will generate and pass a corresponding JRUNTIMEID cookie for clients to store and return with subsequent requests.
`userId`	The unique identifier of the current user.
`userAuthenticated`	Boolean that indicates if the user was authenticated into Storefront Gateway.
The client application retains the User and Runtime entity IDs to use with the Storefront Gateway APIs to perform CRUD operations against those (and other associated) entities.

Unverified AuthN ID Response

If the user tries to authenticate with an unverified email or mobile, the Process resends an action token to that external channel, and then ends without authenticating the user.

**RESPONSE - body**
{ 
   "processId": "21d31975-583c-4ad5-aa3b-909386545032", 
   "output": { 
      "pkat": "d022a6c1-cc00-40f8-b5f2-74b03c7e5a61" 
   }, 
   "lastStep": true 
}

`processId`	The unique identifier for this instance of the Process.
`output`	Object containing additional data that the client can retrain and use for additional operations beyond the Process.
`pkat`	Unique Proof Key for Action Token that corresponds to a `tokenId`, if any.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
Parent topic:Authenticate User Process

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs

Initial Request

Process Complete

Unverified AuthN ID Response

​Initial Request

​Process Complete

​Unverified AuthN ID Response

Initial Request

Process Complete

Unverified AuthN ID Response