fix: B2B-3725 add required b2b headers #2631

bc-victor · 2025-10-07T19:59:34Z

What/Why?

After the release of PROJECT-6952, developers using a BC store-level oauth token with the new B2B Edition oauth scope need to send additional headers for the endpoint to respond properly.

Adding env variable BIGCOMMERCE_ACCESS_TOKEN to differentiate from the type of headers we need to send to the B2B APIs

Testing

Login success ( only place where we use B2B APIs)

With B2B token

Screen.Recording.2025-10-08.at.11.20.59.a.m.mov

Without BC token

Screen.Recording.2025-10-08.at.11.22.03.a.m.mov

Migration

No migrations

changeset-bot · 2025-10-07T19:59:38Z

⚠️ No Changeset found

Latest commit: 0027b89

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-10-07T19:59:42Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
catalyst-b2b	Ready	Preview	Comment	Oct 16, 2025 7:24pm
catalyst-canary	Ready	Preview	Comment	Oct 16, 2025 7:24pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
catalyst	Ignored			Oct 16, 2025 7:24pm

bc-sylvialin · 2025-10-07T23:10:40Z

Hey @bc-victor , this is not a bug. It is intentional to use new headers.

See below articles:
https://developer.bigcommerce.com/b2b-edition/docs/authentication
https://developer.bigcommerce.com/resource-hub/authenticate-bigcommerce-and-b2b-edition-apis-with-one-api-account

bc-micah

I want to see the docs updated + including tests for both the old and new tokens - comments have details.

bc-micah · 2025-10-08T12:36:08Z

core/b2b/client.ts

    env: z.object({
      B2B_API_TOKEN: z.string(),
      BIGCOMMERCE_CHANNEL_ID: z.string(),
+      BIGCOMMERCE_STORE_HASH: z.string(),


Did we update the docs that explain what a B2B_API_TOKEN is as well?

PR here: bigcommerce/docs#1104

bc-micah · 2025-10-08T12:38:29Z

core/b2b/client.ts

+      'X-Store-Hash': BIGCOMMERCE_STORE_HASH,
+      'X-Auth-Token': B2B_API_TOKEN,


Can we include full tests of both tokens (old b2b only s2s token + bigcommerce api account token)?

I would like to see the full flow tested for both scenarios and include showing / setting the env var + verifying the login is working appropriately (including opening the buyer portal as that shows the storefront is logged in as well as the b2b functions)

thanks for the review. After testing realized we can't just send authToken, X-Auth-Token and X-Store-Hash together, we need to know which token is being used. I added a new variable BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE to differntiatte from scopes

bc-victor · 2025-10-08T17:53:44Z

.env.example

+# BigCommerce API token with B2B Edition scopes used to authenticate requests to the B2B API 
+BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE=
+
+# DEPRECATED - Please prefer using the above variable
 # The B2B API Token is used to authenticate requests to the B2B API.
 # It can be generated in the B2B control panel Settings > API Accounts > Create API Account. 
-B2B_API_TOKEN=
+# B2B_API_TOKEN=


maybe lets remove this entirely? also from the docs

can we do it directly?

maybe add a check, if B2B_API_TOKEN is present, throw and show an error message?

z.object({ B2B_API_TOKEN: z.undefined({ message: 'This is deprecated in favour or B2B_API_TOKEN'}).optional(), BIGCOMMERCE_TOKEN: z.string() })

icatalina

pre approving, I think I prefer a more generic token name and removing the old one. What do you all think?

icatalina · 2025-10-10T16:01:03Z

.env.example

+# BigCommerce API token with B2B Edition scopes used to authenticate requests to the B2B API 
+BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE=
+
+# DEPRECATED - Please prefer using the above variable
 # The B2B API Token is used to authenticate requests to the B2B API.
 # It can be generated in the B2B control panel Settings > API Accounts > Create API Account. 
-B2B_API_TOKEN=
+# B2B_API_TOKEN=


can we do it directly?

maybe add a check, if B2B_API_TOKEN is present, throw and show an error message?

z.object({ B2B_API_TOKEN: z.undefined({ message: 'This is deprecated in favour or B2B_API_TOKEN'}).optional(), BIGCOMMERCE_TOKEN: z.string() })

icatalina · 2025-10-10T16:02:19Z

.env.example

 B2B_API_HOST=https://api-b2b.bigcommerce.com

+# BigCommerce API token with B2B Edition scopes used to authenticate requests to the B2B API 
+BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE=


Suggested change

BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE=

BIGCOMMERCE_TOKEN=

if we require new scopes in the future, are we gonna rename the variable to:

BIGCOMMERCE_TOKEN_WITH_B2B_AND_SOME_OTHER_SCOPE=

?

Thats a good point, I'll add this

"With x scope" seems like an awkward naming convention in general to me.

Just for reference, the optional BigCommerce REST token that can be included in the environment config for, e.g., supporting the customer groups lookup in Makeswift, is called BIGCOMMERCE_ACCESS_TOKEN. We might want to conform the naming convention here to more closely match that.

Or is it possibly appropriate to just use BIGCOMMERCE_ACCESS_TOKEN and give clear instructions that the token provided there needs to have the B2B scope? I think that might make more sense than having separate BigCommerce REST tokens for separate operations.

If it's already being used in makeswift, let's stick to the existing name to reduce the number of things the user has to setup.

We can then just add that B2B scope is required in the setup docs.

CNanninga · 2025-10-13T14:47:07Z

.env.example

 B2B_API_HOST=https://api-b2b.bigcommerce.com

+# BigCommerce API token with B2B Edition scopes used to authenticate requests to the B2B API 
+BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE=


"With x scope" seems like an awkward naming convention in general to me.

Just for reference, the optional BigCommerce REST token that can be included in the environment config for, e.g., supporting the customer groups lookup in Makeswift, is called BIGCOMMERCE_ACCESS_TOKEN. We might want to conform the naming convention here to more closely match that.

Or is it possibly appropriate to just use BIGCOMMERCE_ACCESS_TOKEN and give clear instructions that the token provided there needs to have the B2B scope? I think that might make more sense than having separate BigCommerce REST tokens for separate operations.

bc-micah · 2025-10-13T22:34:06Z

core/b2b/client.ts

+  if (B2B_API_TOKEN) {
+    headers['authToken'] = B2B_API_TOKEN;
+  }
+
+  if (BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE) {
+    headers['X-Auth-Token'] = BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE;
+    headers['X-Store-Hash'] = BIGCOMMERCE_STORE_HASH;
+  }


Suggested change

if (B2B_API_TOKEN) {

headers['authToken'] = B2B_API_TOKEN;

}

if (BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE) {

headers['X-Auth-Token'] = BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE;

headers['X-Store-Hash'] = BIGCOMMERCE_STORE_HASH;

}

if (BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE) {

headers['X-Auth-Token'] = BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE;

headers['X-Store-Hash'] = BIGCOMMERCE_STORE_HASH;

} else if (B2B_API_TOKEN) {

headers['authToken'] = B2B_API_TOKEN;

}

They both should not be used at the same time, we should prefer the BIGCOMMERCE_TOKEN if possible.

bc-micah · 2025-10-13T22:36:01Z

.env.example

 B2B_API_HOST=https://api-b2b.bigcommerce.com

+# BigCommerce API token with B2B Edition scopes used to authenticate requests to the B2B API 
+BIGCOMMERCE_TOKEN_WITH_B2B_SCOPE=


If it's already being used in makeswift, let's stick to the existing name to reduce the number of things the user has to setup.

We can then just add that B2B scope is required in the setup docs.

bc-victor · 2025-10-14T03:30:45Z

Updated this PR to use BIGCOMMERCE_ACCESS_TOKEN as defined here in the Makeswift integration.

Updating docs in this PR

bc-micah · 2025-10-16T15:39:51Z

core/b2b/client.ts

+  } else {
+    throw new Error(`No B2B API token or BigCommerce token found in environment variables.`);
+  }


This is only using the new BIGCOMMERCE_ACCESS_TOKEN, will break when existing customers upgrade to this version.

icatalina · 2025-10-16T16:07:13Z

core/b2b/client.ts

      BIGCOMMERCE_CHANNEL_ID: z.string(),
+      BIGCOMMERCE_STORE_HASH: z.string(),
+      BIGCOMMERCE_ACCESS_TOKEN: z.string().optional(),
+      B2B_API_TOKEN: z.string().optional().describe('This is deprecated in favour or BIGCOMMERCE_ACCESS_TOKEN, read https://support.bigcommerce.com/s/article/Store-API-Accounts?language=en_US'),


💅 Not sure if we need the describe here.

We might want to define a union in this case:

z.union([ z.object({ BIGCOMMERCE_CHANNEL_ID: z.string(), B2B_API_TOKEN: z.string(), }), z.object({ BIGCOMMERCE_CHANNEL_ID: z.string(), BIGCOMMERCE_STORE_HASH: z.string(), BIGCOMMERCE_ACCESS_TOKEN: z.string(), }), ])

The current approach makes BIGCOMMERCE_STORE_HASH mandatory, even for old consumers where it is not needed, and makes both B2B_API_TOKEN and BIGCOMMERCE_ACCESS_TOKEN which mean they can potentially be both missing.

bc-victor requested a review from a team as a code owner October 7, 2025 19:59

vercel bot deployed to Production – catalyst-b2b October 7, 2025 20:18 View deployment

bc-micah reviewed Oct 8, 2025

View reviewed changes

bc-victor force-pushed the victor/b2b-makeswift branch from c0129ec to 761ca3b Compare October 8, 2025 16:55

bc-victor changed the title ~~fix: add required b2b headers~~ fix: B2B-3725 add required b2b headers Oct 8, 2025

vercel bot deployed to Preview – catalyst-canary October 8, 2025 16:57 View deployment

vercel bot deployed to Preview – catalyst-b2b October 8, 2025 16:57 View deployment

bc-victor force-pushed the victor/b2b-makeswift branch from 761ca3b to b3641af Compare October 8, 2025 17:22

vercel bot deployed to Preview – catalyst-canary October 8, 2025 17:24 View deployment

vercel bot deployed to Preview – catalyst-b2b October 8, 2025 17:24 View deployment

bc-victor commented Oct 8, 2025

View reviewed changes

bc-victor requested a review from bc-micah October 8, 2025 18:59

icatalina reviewed Oct 10, 2025

View reviewed changes

CNanninga suggested changes Oct 13, 2025

View reviewed changes

bc-micah reviewed Oct 13, 2025

View reviewed changes

bc-victor force-pushed the victor/b2b-makeswift branch from b3641af to ad75212 Compare October 14, 2025 02:08

vercel bot deployed to Preview – catalyst-canary October 14, 2025 02:09 View deployment

vercel bot deployed to Preview – catalyst-b2b October 14, 2025 02:09 View deployment

bc-victor requested review from CNanninga, bc-micah and icatalina October 14, 2025 20:01

bc-micah reviewed Oct 16, 2025

View reviewed changes

bc-victor force-pushed the victor/b2b-makeswift branch 2 times, most recently from 50de4a7 to d8d8a48 Compare October 16, 2025 16:00

vercel bot deployed to Preview – catalyst-canary October 16, 2025 16:02 View deployment

vercel bot deployed to Preview – catalyst-b2b October 16, 2025 16:02 View deployment

icatalina approved these changes Oct 16, 2025

View reviewed changes

fix: B2B-3725 add required b2b headers

0027b89

bc-victor force-pushed the victor/b2b-makeswift branch from d8d8a48 to 0027b89 Compare October 16, 2025 19:22

vercel bot deployed to Preview – catalyst-b2b October 16, 2025 19:24 View deployment

vercel bot deployed to Preview – catalyst-canary October 16, 2025 19:24 View deployment

bc-victor merged commit ab06c1b into integrations/b2b-makeswift Oct 16, 2025
11 checks passed

bc-victor deleted the victor/b2b-makeswift branch October 16, 2025 19:35

		'X-Store-Hash': BIGCOMMERCE_STORE_HASH,
		'X-Auth-Token': B2B_API_TOKEN,

fix: B2B-3725 add required b2b headers #2631

fix: B2B-3725 add required b2b headers #2631

Uh oh!

Conversation

bc-victor commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why?

Testing

Migration

Uh oh!

changeset-bot bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bc-sylvialin commented Oct 7, 2025

Uh oh!

bc-micah left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

icatalina left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bc-victor commented Oct 14, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

bc-victor commented Oct 7, 2025 •

edited

Loading

changeset-bot bot commented Oct 7, 2025 •

edited

Loading

vercel bot commented Oct 7, 2025 •

edited

Loading