---
title: "Security"
slug: "security"
abstract: ""
---
# Security

Security in Sitecore Experience Commerce is based on specific authenticated identities and uses [bearer token authentication](https://doc.sitecore.com/xp/en/developers/101/sitecore-experience-commerce/bearer-token-authentication.html "Bearer token authentication"). Security is enforced at the controller level, and is based on a user's Sitecore credentials. Every user must be authenticated to be able to call any controller from the Commerce Engine.