B2C Business Manager Users, Roles, and Access Keys

Use the b2c bm commands to administer instance-level Business Manager resources (users, roles, access keys) over SCAPI. These commands target a specific Commerce Cloud instance — pass --server/-s or set the active instance in dw.json first.

Tip: If b2c is not installed globally, use npx @salesforce/b2c-cli instead (e.g., npx @salesforce/b2c-cli bm whoami).

For Account Manager user/role/client management (cross-instance, scoped to tenants), see the b2c-cli:b2c-am skill instead.

API Backend

bm users (list, get, portable search, update, delete) and bm roles (all subcommands including permissions) run over the SCAPI Merchant Users / Merchant Roles APIs. Configure shortCode, tenantId, and the sfcc.users(.rw) / sfcc.roles(.rw) scopes to use SCAPI. Search is implemented by filtering the paginated SCAPI user listing.

OCAPI-only operations as of B2C Commerce release 26.8 (no current live SCAPI equivalent, unavailable on OCAPI-disabled instances): raw bm users search --query JSON, bm whoami, and bm access-key *. auto uses the temporary OCAPI compatibility path. Explicit SCAPI mode fails before contacting OCAPI and directs the user to --api-backend ocapi until support becomes available.

OCAPI is deprecated and disabled on newer instances. --api-backend auto (the default) falls back on safe SCAPI capability/auth/request rejections; force a backend with --api-backend scapi|ocapi if needed. SCAPI updates disabled by reading the current user and preserving its writable fields through PUT because PATCH omits that field.

Authentication

The CLI auto-discovers the target instance and credentials from SFCC_* environment variables, dw.json in the current or parent directories, ~/.mobify, package.json, and configuration plugins. Flags like --server, --client-id, and --client-secret are usually unnecessary — only pass them to override what's auto-detected. Run b2c setup inspect to see the resolved configuration and which source provided each value. For precedence and troubleshooting, see the b2c-cli:b2c-config skill.