---
schema_version: "1"
id: 6f54c8a60ba4a94cdc57f973fc79146f4c981125031dbfa73273a793b4b2b2cb
title: Generate a Frontdoor URL to Bridge into UI Sessions
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/frontdoor_singleaccess.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.frontdoor_singleaccess.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b4675855da54e0745739d9af2141d3cf2e5d1cad83476b274e1d4e8671924461
description: To give users uninterrupted access to Salesforce and other apps, use an existing session to automatically log users into a new UI without making them enter their credentials again. For example, redirect users from a custom app to a specific record in Salesforce. To bridge from one session to another, use Single Access UI Bridge API (UI Bridge API for short). With this API, exchange an access token for a frontdoor URL that you use to load a new session. You can also specify a redirect URI where users are sent when their new session begins.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Generate a Frontdoor URL to Bridge into UI Sessions

To give users uninterrupted access to Salesforce and other apps, use an existing session to automatically log users into a new UI without making them enter their credentials again. For example, redirect users from a custom app to a specific record in Salesforce. To bridge from one session to another, use Single Access UI Bridge API (UI Bridge API for short). With this API, exchange an access token for a frontdoor URL that you use to load a new session. You can also specify a redirect URI where users are sent when their new session begins.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

## How UI Bridge API Works

Think of the access token from the user’s existing session as a key and the frontdoor URL as a door that guards access to Salesforce UIs. With the access token as their key, the user can walk straight through the door into a Salesforce UI with a brand-new session.

Here are a few examples of how you can use this feature.

If you use Salesforce headless identity flows for an off-platform app, you can bridge headless app sessions into Salesforce UIs. For example, you host an ecommerce site on a headless, off-platform app that uses Salesforce headless identity flows. You also use a Salesforce Experience Cloud site to manage customer support cases. In your headless app, you want to display a button for each of a user’s active support cases so that they can jump to a specific case and view its details. To see the case details, the user must go to the Experience Cloud site. At this point, the user has already logged in to your headless app, but doesn’t have a session with the Experience Cloud site yet.

Instead of making the user log in again when they’re redirected, you can use UI Bridge API. You send the user’s access token from their headless app session to the `services/oauth2/singleaccess` endpoint on your Experience Cloud site. For the redirect URI, you specify a path that points to the specific Salesforce case that the user requests to see. UI Bridge API responds to this request with a frontdoor URL. The headless app redirects the user to the frontdoor URL, automatically logs them into the Experience Cloud site UI, and redirects them to their case.

Another use case is launching from an existing session in one app into an OAuth flow in a second app. For example, you’re using an Experience Cloud site as a single sign-on (SSO) provider for multiple headless and headed apps. You want to bridge a session initiated in a headless app into a headed app. You send the access token from the headless session to UI Bridge API, specifying the authorization URL of the headed app as your redirect URI. You use the resulting frontdoor URL to load a new session in the headed app. The user is logged in to the Experience Cloud SSO provider and immediately redirected to the authorization URL of the headed app. The headed app then begins an OAuth flow. At the end of this process, the user is logged into both apps with minimal disruption.

## How to Use UI Bridge API

To get a frontdoor URL, send a POST or GET request to the services/oauth2/singleaccess endpoint. This endpoint supports My Domain and Experience Cloud site URLs only. Other login URLs such as login.salesforce.com and test.salesforce.com aren’t supported.

Include these parameters in the request to the services/oauth2/singleaccess endpoint.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e102">Header</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e105">Required?</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e108">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Header" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e102 ">
              <code>Authorization: Bearer</code>
            </td>

            <td data-label="Required?" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e105 ">Required for GET requests. For GET requests, you can send the access token only
              in an Authorization header. For POST requests, you can send the access token in this
              header or in the request body.</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e108 ">
              <p>The access token from the user’s initial session. It can be an opaque access
                token or a JSON Web Token (JWT)-based access token. The access token must have the
                <code>web</code> or <code>full</code> scope. Specify scopes in the
                external client app settings for the app that issued the access token.
              </p>
              <p style="margin-bottom:0;">The user
                associated with the access token can't have the API Only User
                permission.</p>
            </td>

          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e155">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e158">Required?</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e161">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e155 ">
              <code>access_token</code>
            </td>

            <td data-label="Required?" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e158 ">
              <p>For POST requests only, required in the request body only if you don’t send the
                access token in a header.</p>
              <p style="margin-bottom:0;">This parameter isn't supported for GET
                requests.</p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e161 ">
              <p>The access token from the user’s initial session. It can be an opaque access
                token or a JSON Web Token (JWT)-based access token. The access token must have the
                <code>web</code> or <code>full</code> scope. Specify scopes in the
                external client app settings for the app that issued the access token.
              </p>
              <p style="margin-bottom:0;">The user
                associated with the access token can't have the API Only User
                permission.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e155 ">
              <code>redirect_uri</code>
            </td>

            <td data-label="Required?" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e158 ">No. If you don’t include a <code>redirect_uri</code>,
              users are taken to the homepage for the My Domain or Experience Cloud site.</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e161 ">
              <p>A relative path that points to where the user is redirected when their new
                session begins. You can specify any path on a Salesforce domain. For example, point
                users to a specific account page, object, or record.</p>
              <p style="margin-bottom:0;">For Experience Cloud sites,
                if your URL’s root path includes a suffix, include the suffix when you specify the
                relative path. For example, if your root URL is
                <samp class="filepath">https://myexperiencecloudsite.com/mysitename</samp>, and you want
                to direct users to a page called <samp class="filepath">mypage</samp>, include the site
                suffix <samp class="filepath">mysitename</samp> in your <code>redirect_uri</code> so that the full value is <code>mysitename/mypage</code>.
              </p>
            </td>

          </tr>
        </tbody>
      </table>

Here’s an example that generates a frontdoor URL that redirects to an org’s user management page in Setup. This example is a POST request with the access token in the request body.

```
POST /services/oauth2/singleaccess? HTTP 1.1
Host: mydomainname.my.salesforce.com

access_token=**************&
redirect_uri=lightning/setup/ManageUsers/home
```

This example also generates a frontdoor URL that redirects to an org’s user management page, but it uses a GET request. For security, GET requests must send the access token in a header.

```
GET /services/oauth2/singleaccess? HTTP 1.1
Host: mydomainname.my.salesforce.com
Authorization: Bearer <access token>

redirect_uri=lightning/setup/ManageUsers/home
```

This POST example generates a frontdoor URL that redirects to a custom page called mypage in an Experience Cloud site. The Experience Cloud site’s root path includes a suffix, so the redirect URI also includes this suffix.

```
POST /services/oauth2/singleaccess? HTTP 1.1
Host: myexperiencecloudsite.com/mysitename

access_token=**************&
redirect_uri=mysitename/mypage
```

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Depending on the type of Experience Cloud site and when it was created, some Experience Cloud site URLs include `/s`. For more information, see [Custom URL Paths in LWR Sites](https://developer.salesforce.com/docs/atlas.en-us.exp_cloud_lwr.meta/exp_cloud_lwr/template_differences_url.htm).

If successful, the API returns a JSON response with the frontdoor URL. Here’s what the response looks like if you include a `redirect_uri`, which is reflected in the `startURL` value. If you don’t include a `redirect_uri`, the frontdoor URL doesn’t include a `startURL`.

```
{
"frontdoor_uri": "https://mydomainname.my.salesforce.com/secur/frontdoor.jsp?otp=*****&startURL=lightning%2Fsetup%2FManageUsers%2Fhome&cshc=x000001X7tNx0000006GpL"
}
```

The frontdoor URL in the response is valid for up to 1 minute from when it was returned and can be used only one time. During this time frame, if you send the same request to UI Bridge API, it returns the exact same URL. If you make multiple requests, it doesn’t extend the expiration time of this URL. The endpoint returns a new URL only when the first one has expired.

If unsuccessful, the API returns an error. Here’s an example error response.

```
Bad_OAuth_Token
```

Here’s a list of errors and suggestions for resolving them.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e307">Error Message</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d63765e310">Error Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e307 "><code>Bad_OAuth_Token</code></td>

            <td data-label="Error Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e310 ">
              <p>The access token isn't valid. For example, the token expired. Try getting a
                new access token.</p>
              <p style="margin-bottom:0;"><code>Bad_OAuth_Token</code> is also returned if the
                user associated with the token has the API Only User permission. If the user
                requires UI access, remove this permission.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e307 "><code>Missing_OAuth_Token</code></td>

            <td data-label="Error Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e310 ">We can't find an access token in the request. Include an access token in either
              an Authorization header (supported for GET and POST requests) or in the
              <code>access_token</code> parameter (supported only for POST
              requests).
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e307 ">
              <code>Invalid_Param</code>
            </td>

            <td data-label="Error Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e310 ">The <code>redirect_uri</code> isn’t valid. For example, it’s an absolute
              URL. Use a relative path only.</td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e307 ">
              <code>Invalid_Scope</code>
            </td>

            <td data-label="Error Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e310 ">The access token doesn’t include either the <code>web</code> or
              <code>full</code> scope. Check that one of these scopes is assigned to the
              external client app that’s issuing the access token.
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e307 ">
              <code>No_Access</code>
            </td>

            <td data-label="Error Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e310 ">The request was sent to an invalid domain, such as
              <samp class="filepath">login.salesforce.com</samp> or
              <samp class="filepath">test.salesforce.com</samp>. Use a My Domain or Experience Cloud site
              URL only.
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e307 ">
              <code>Wrong_Org</code>
            </td>

            <td data-label="Error Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d63765e310 ">The request was sent to a domain that’s different from the org where the access
              token was issued. Make sure that these values match.</td>

          </tr>
        </tbody>
      </table>