Salesforce Docs Portal

Configure a Code and Credentials Flow

The Code and Credentials Flow is the foundation of headless login, registration, passwordless login, and guest user identity. Before setting up these features, enable the Code and Credentials Flow at an org-wide level and configure these required settings and access policies for your external client app.

Required Editions

Available in: Lightning Experience
Available in: Professional, Performance, Unlimited, and Developer Editions
User Permissions Needed
To configure an External Client App for OAuth 2.0 Code and Credentials Flows Create, edit, and delete External Client Apps
  1. To access the Code and Credentials Flow settings, allow external client apps to access the flow.
    Note
    Note By default, the Code and Credentials Flow is blocked for all external client apps.
    1. From Setup, in the Quick Find box, enter OAuth, and then select OAuth and OpenID Connect Settings.
    2. Turn on Allow Authorization Code and Credentials Flows.
  2. Create your external client app and complete its basic information.
  3. Set up the basic OAuth settings for the app, including these settings.
    1. Enable OAuth.
    2. Enter a callback URL.
    3. Assign scopes to the app.
  4. Configure these specific settings for the Authorization Code and Credentials Flow.
    1. (Optional) To require the Proof Key for Code Exchange (PKCE) extension for your flow, select Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows.
      With this setting selected, you must implement PKCE when you build your flow. We strongly recommend PKCE for public clients, because these apps can’t use the consumer secret to protect the code exchange. We also recommend it for private clients, but it’s less critical.
    2. Select Enable Authorization Code and Credentials Flow.
    3. (Optional) To require your third-party client app to send the user’s credentials in the body of HTTP POST requests to the authorization endpoint, select Require user credentials in the POST body for Authorization Code and Credentials Flow.
      With this setting enabled, you can’t use the GET method for the authorization request, and you can’t include user credentials in a Basic authorization header.
    4. If you’re using a client backend to implement this flow for a private client, select Require Secret For Web Server Flow and Require Secret for Refresh Token Flow.
      Ensure that your client back end can keep the consumer secret secure.
    5. If you’re using this flow for a public client, deselect Require Secret For Web Server Flow and Require Secret for Refresh Token Flow to avoid exposing the consumer secret to the browser.
    6. Save your settings.