Credentials

The B2C Credentials tool window, on the right next to B2C Explorer, holds every secret the plugin uses: Business Manager accounts, their per-host access keys and OCAPI API clients. Connections only point at an account or a client, so one account can serve many instances. Secrets stay in the IDE password safe, or in one encrypted file you can share between machines

STstorefrontSandbox 01version2

Cart.js

1'use strict';

2

3var server = require('server');

4server.extend(module.superModule);

5

6server.append('Show', function (req, res, next) {

7 next();

8});

B2C CredentialsAccountsOCAPISettings

Credentials File

Accounts: 3OCAPI Credentials: 2File Updated: 05 October 2026 - 07:42:10

Open File LocationReimport Credentials

Unlink FileFile will remain untouchable, you can link to it again whenever you want

Delete FileCredentials File will be deleted and local IDE Secure Storage will be used as a fallback

Secret Key

Secret Keyq7Lx-2mRf-9TcB-4wZaCOPY SECRET KEYSecret key will be used to encrypt/decrypt your credentials file.
IMPORTANT: For security reason, we can show you this key only once at current step.

OK, I copied Secret Key

storefrontapp_customcartridgecontrollersCart.jsRefArch (3)LFUTF-8

The window has three tabs: Accounts, OCAPI and Settings. Each list tab has Add, Edit and Remove in its toolbar plus a refresh button, and right-clicking a row copies its values

Accounts

The Accounts tab lists accounts by username. Add opens New Account with Username and Password. The password field has a show and hide toggle and a copy button

• The username must use the same text case as on the instance. If the instance stores it in lowercase, either add it in lowercase or turn on Use lowercase username on authentication requests in Connections
• Removing an account asks for confirmation, because connections that use it stop working
• Right-click an account to Copy username, Copy password, or copy an access key from the Access Keys submenu, which has one entry per host

Access keys

Access keys replace the password for one host and one purpose. Use them when an instance doesn't accept the Business Manager password for WebDAV

1. Add the account first, then select it and click Edit. The Access Keys table appears only when you edit an existing account
2. Click Add in the Access Keys table and pick the Hostname (start typing to get suggestions)
3. Paste the keys you generated in Business Manager

The table shows one row per host with a check for each key it holds. Copy them later from the account's right-click menu

OCAPI

The OCAPI tab lists API clients by name and client ID. Add opens New OCAPI Credentials with Name, Client ID and Client Secret. Passwords and client secrets are stored in a secure private vault, not in the project

A built-in OOTB Test Creds entry is always there and can't be deleted. Its client works on sandboxes and test systems without any Account Manager setup, so you can try OCAPI before you create your own client. The instance still needs OCAPI permissions for it, see OCAPI & Jobs

Right-click a client to Copy Client ID or Copy Client Secret. Pick the client in a connection's OCAPI tab, or in a sandbox configuration in On-Demand Sandboxes

Sync credentials to a file

By default credentials live in the IDE password safe on one machine. The Settings tab moves them into one encrypted file instead. Put that file in a synced folder such as iCloud Drive or OneDrive, and every IDE linked to it shares the same accounts and clients

Once a file is linked, the Settings tab shows a Credentials File card with the number of accounts and OCAPI credentials and when the file was last updated

While a file is linked, every change you make in B2C Credentials is written to it. Changes made on another machine are picked up by a file watcher, and a B2C Credentials Updated balloon with Open File Location confirms the sync. The IDE remembers the file path and the secret key in its application settings, so you enter the key once per machine

Troubleshooting

Related