b2c-developer-tooling: Skill for Claude Code

API Client Development

This skill covers creating typed API clients using OpenAPI specifications, with proper authentication and OAuth scope handling. It builds on the patterns in SDK Module Development.

Overview

API clients in this project use:

• openapi-fetch: Type-safe HTTP client generated from OpenAPI specs
• openapi-typescript: Generates TypeScript types from OpenAPI specs
• Middleware pattern: Auth and logging injected via openapi-fetch middleware
• Shared transport: every client is created with createHttpClient(options, auth) from src/clients/http-transport.ts (never openapi-fetch's createClient), so the transport options carried by the client's auth strategy apply

Shared HTTP Transport (required)

TLS behavior such as the internal selfsigned-api mode is set on the fetch call (an undici dispatcher), not on the Request, so middleware cannot add it. The setting is per config, not global: strategies created from a resolved config (createOAuth(), B2CInstance, resolveAuthStrategy, OAuthCommand) carry selfSignedApi, withAdditionalScopes()/withScopes() preserve it, and clients built from the strategy inherit it. src/clients/http-transport.ts owns the policy:

• createHttpClient<paths>(options, auth) — use instead of openapi-fetch's createClient; pass the client's auth strategy. ESLint (no-restricted-imports) fails a direct default import of openapi-fetch in src/.
• getApiFetch(auth) — use instead of the global fetch for any direct OCAPI, SCAPI, Account Manager or MRT request (token calls, retries, hand-rolled requests). Pass the strategy or config the request belongs to. ESLint (no-restricted-globals) fails a bare fetch in src/ outside an allowlist of non-B2C hosts.
• New strategies or config types that make API requests should accept HttpTransportOptions (selfSignedApi) and pass it through; a strategy wrapper must copy selfSignedApi from the strategy it wraps. Anything that does not receive it stays on strict TLS.
• APIs that take a dispatcher instead of a fetch (an auth strategy's fetch() init) use getApiDispatcher(auth); WebSockets use createApiWebSocket(url, auth) (see src/operations/mrt/tail-logs.ts).
• SCAPI Admin APIs on {shortCode}.api.commercecloud.salesforce.com should use buildScapiClient() (src/clients/scapi-client-factory.ts), which already uses the shared transport plus auth, rate-limit and logging middleware.
• If a client needs a custom fetch option, call getApiFetch(auth) inside it (see src/scapi/request.ts).
• WebDAV is separate: B2CInstance.webdav uses createWebDavDispatcher(tlsOptions) from the same module, driven by selfsigned/client certificates, never by selfSignedApi.