Loading
Salesforce now sends email only from verified domains. Read More
Identify Your Users and Manage Access
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Configure a Code and Credentials Flow

            You are here:

            1. Salesforce Help
            2. Docs
            3. Identify Your Users and Manage Access

            Configure a Code and Credentials Flow

            The Code and Credentials Flow is the foundation of headless login, registration, passwordless login, and guest user identity. Before setting up these features, enable the Code and Credentials Flow at an org-wide level and configure these required settings and access policies for your external client app.

            Required Editions

            Available in: Lightning Experience
            Available in: Professional, Performance, Unlimited, and Developer Editions
            User Permissions Needed
            To configure an External Client App for OAuth 2.0 Code and Credentials Flows Create, edit, and delete External Client Apps
            1. To access the Code and Credentials Flow settings, allow external client apps to access the flow.
              Note
              Note By default, the Code and Credentials Flow is blocked for all external client apps.
              1. From Setup, in the Quick Find box, enter OAuth, and then select OAuth and OpenID Connect Settings.
              2. Turn on Allow Authorization Code and Credentials Flows.
            2. Create your external client app and complete its basic information.
            3. Set up the basic OAuth settings for the app, including these settings.
              1. Enable OAuth.
              2. Enter a callback URL.
              3. Assign scopes to the app.
            4. Configure these specific settings for the Authorization Code and Credentials Flow.
              1. (Optional) To require the Proof Key for Code Exchange (PKCE) extension for your flow, select Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows.
                With this setting selected, you must implement PKCE when you build your flow. We strongly recommend PKCE for public clients, because these apps can’t use the consumer secret to protect the code exchange. We also recommend it for private clients, but it’s less critical.
              2. Select Enable Authorization Code and Credentials Flow.
              3. (Optional) To require your third-party client app to send the user’s credentials in the body of HTTP POST requests to the authorization endpoint, select Require user credentials in the POST body for Authorization Code and Credentials Flow.
                With this setting enabled, you can’t use the GET method for the authorization request, and you can’t include user credentials in a Basic authorization header.
              4. If you’re using a client backend to implement this flow for a private client, select Require Secret For Web Server Flow and Require Secret for Refresh Token Flow.
                Ensure that your client back end can keep the consumer secret secure.
              5. If you’re using this flow for a public client, deselect Require Secret For Web Server Flow and Require Secret for Refresh Token Flow to avoid exposing the consumer secret to the browser.
              6. Save your settings.
             
            Loading
            Salesforce Help | Article