> ## Documentation Index
> Fetch the complete documentation index at: https://docs.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Machine-to-Machine Authentication

Storefront Gateway provides the capability for partner systems to integrate with Storefront Gateway for a variety of automated tasks. Uses for these APIs include:

* Provision Users and Accounts, in bulk, from external records into your Storefront Gateway data store.
* Update/synchronization between Storefront Gateway and external systems (e.g. B/OSS systems).
* Service entitlements and privacy management.

## API Access

Partner systems access protected M2M APIs by including the `{partner key}:{partner secret}` in the `X-Partner-AUTHZ` header of each call. The key and secret are returned from Storefront Gateway when you provision a partner with `POST /partners` API.

Certain M2M endpoints used as part of a MarketONE integration may alternatively be protected by a MarketONE Partner API key. These API keys are shared across MarketONE services (as an example, MarketONE Partner API keys obtained from PLM would also be functional with compatible Storefront Gateway endpoints). MarketONE Partner API keys can be presented to Storefront Gateway via the `X-API-KEY` header of each call. At present, the **POST /runtime/event** API is the only Storefront Gateway API supporting authentication via the MarketONE Partner API key.

**Note:** M2M authentication methods are not interchangeable. Storefront Gateway APIs that require authentication using a MarketONE Partner API key will not accept any token provided via the `X-Partner-AUTHZ` header and vice versa. You must supply a valid authentication key matching the support M2M authentication method.

## Example - POST /oidc/token

In the following example, a partner system invokes the `POST /oidc/token` API to request an access token. This example demonstrates the use of Storefront Gateway's client credentials flow.

```
**REQUEST - URL**
POST https://~your.url/rest/{version}/oidc/token?client_id=XXXX&client_secret=XXXX&grant_type=client_credentials
```

**Query Parameters**

| `client_id` | Specifies both the media type (of the content of the request body) that the client sends to the Storefront Gateway, as well as the media type (of the content of the response body) that Storefront Gateway returns to the client. Value must be: `Application/JSON` |
| - | - |
| `client_secret` | The Partner Key and Partner Secret, respectively. |
| `grant_type` | Value must be: `client_credentials` |

## Example - POST activation/user

In the following example, a partner system invokes the `POST /activation/user` API to provision a new Storefront Gateway User entity. This example demonstrates the use of Storefront Gateway's core M2M authentication method via the `AuthorizationX-Partner-AUTHZ` header.

```
**REQUEST - URL**
POST https://~your.url/rest/{version}/activation/user
```

**Headers**

| `Content-Type` | Specifies both the media type (of the content of the request body) that the client sends to the Storefront Gateway, as well as the media type (of the content of the response body) that Storefront Gateway returns to the client. Value must be: `Application/JSON` |
| - | - |
| `AuthorizationX-Partner-AUTHZ` | Bearer accessToken with correct m2m scope The Partner Key and Partner Secret, respectively. Base 64 encoding of: `**\{Partner Key\}:\{Partner Secret\}**` |

```
**REQUEST - body**
{ 
   "displayName": "demo", 
   "emailAddress": "demo@test.com", 
   "username": "demo@test.com", 
   "type":"com.uxpsystems.mint.user.RegularUser" 
}
```

## M2M Activation APIs

Storefront Gateway M2M APIs are stateless and do not require a user context. They use access tokens for authentication within the OIDC framework.

ULM has special OIDC scopes for m2m access. Once cusomer configures OIDC client for m2m access with correct scopes the can use client\_credentials OIDC flow to generate accessToken and use this token to access ULM m2m APIs

Storefront Gateway allow customers to manage Storefront Gateway entities, and synchronize them with customer information in their own systems. The machine clients access these APIs to add or delete a user, and modify user attribute(s):

* [Delete a User by User Attibute (Machine-to-machine)](https://app.swaggerhub.com/apis/Amdocs_Media/ULM-Activation-APIs/Draft-Go#/user/removeUserByAttributeUsingDELETE): `DELETE /activation/user/byattribute/{attributeName}/{attributeValue}`
* [Update a user by a specific attribute (Machine-to-machine)](https://app.swaggerhub.com/apis/Amdocs_Media/ULM-Activation-APIs/Draft-Go#/user/updateUserStatusByAttributeUsingPOST): `POST /activation/user/status/byattribute/{attributeName}/{attributeValue}`
* [Add a user](https://app.swaggerhub.com/apis/Amdocs_Media/ULM-Activation-APIs/Draft-Go#/user/addUserPOST): `POST /activation/addUser`

See Connect Activation APIs used for more details.

**Parent topic:**[API Authentication](c_apiAuthentication)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.