--- schema_version: "1" id: e13df8411d05997e8ba0a4089108f1a57eea9273804ac9c7a35e6556602e5907 title: Headless Identity Implementation Checklists collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/headless_identity_implementation_checklist.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_implementation_checklist.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: f4ff0b9dff65dd778d31f4d465e9f8457e9a90e66d041a58e1f152774391cab3 description: As you set up Headless Identity features, use these checklists to guide you. products: - Security - Cross Cloud release: "264" --- # Headless Identity Implementation Checklists As you set up Headless Identity features, use these checklists to guide you. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: Enterprise, Unlimited, and Developer Editions
Looking for more guidance? To set up an end-to-end example implementation with a public client, see the Headless Identitly Implementation Guide. ## Headless Login To set up headless login, complete these steps to configure the simplest variation of the Authorization Code and Credentials Flow. 1. Complete [prerequisites for Headless Identity](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_prerequisites.htm&release=264.0.0&type=5 "Before you get started with a Headless Identity implementation for your off-platform apps, cross off these prerequisites in Salesforce."). 2. Set up a [connected app for the Authorization Code and Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.authorization_code_credentials_configure.htm&type=5&language=en_US). 3. Build the Authorization Code and Credentials Flow. The way you build it depends on your app type. - [Public Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_authcodecreds_singlepageapp.htm&release=264.0.0&type=5 "For public clients such as single-page apps or mobile apps, you can set up headless login for customers and partners by using the Authorization Code and Credentials Flow. This flow is built on the OAuth 2.0 Authorization Code grant type. With the Authorization Code and Credentials Flow, you control the front-end login experience in a third-party app. You call Salesforce Headless Login APIs via your Experience Cloud site to handle the back-end work of authenticating users and granting access to protected Salesforce resources. With separate front-end and back-end processes, your users can log in and access Salesforce data without leaving your app. For single-page apps, you use a server-side callback endpoint to extract the authorization code, and you perform the code exchange from the browser via client-side JavaScript.") - [Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_authorization_code_credentials_flow.htm&release=264.0.0&type=5 "For private clients, such as client-server apps, you can set up headless login for customers and partners by using the Authorization Code and Credentials Flow, which is built on the OAuth 2.0 Authorization Code grant type.") ## Headless Registration To configure headless registration, complete these steps. The Headless Registration Flow is an extension to the Authorization Code and Credentials Flow. To set up the Headless Registration Flow, see these resources in Salesforce Help. 1. [Complete prerequisites for Headless Identity](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_prerequisites.htm&release=264.0.0&type=5 "Before you get started with a Headless Identity implementation for your off-platform apps, cross off these prerequisites in Salesforce."). 2. Set up a [connected app for the Authorization Code and Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.authorization_code_credentials_configure.htm&type=5&language=en_US). 3. [Configure Experience Cloud settings for headless registration](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_registration_settings.htm&type=5&language=en_US). 4. Build the Headless Registration Flow. The way you build it depends on your app type. 1. [Public Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_registration_public_clients.htm&type=5&language=en_US) 2. [Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_registration_private_clients.htm&type=5&language=en_US) 5. Optionally, if your flow uses email verification, [customize the email that users receive with their one-time password](https://help.salesforce.com/s/articleView?id=experience.networks_headless_registration_email.htm&type=5&language=en_US) (OTP). ## Headless Passwordless Login To configure headless passwordless login, complete these steps. The Headless Passwordless Login Flow is an extension to the Authorization Code and Credentials Flow. 1. [Complete prerequisites for Headless Identity](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_prerequisites.htm&release=264.0.0&type=5 "Before you get started with a Headless Identity implementation for your off-platform apps, cross off these prerequisites in Salesforce."). 2. Set up a [connected app for the Authorization Code and Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.authorization_code_credentials_configure.htm&type=5&language=en_US). 3. Configure [Experience Cloud settings for headless passwordless login](https://help.salesforce.com/s/articleView?id=xcloud.headless_passwordless_login_settings.htm&release=264.0.0&type=5 "Before you build the Headless Passwordless Login Flow, configure these settings for security and access."). 4. Build the Headless Passwordless Login Flow. The way you build it depends on your app type. 1. [Public Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_passwordless_login_public_clients.htm&release=264.0.0&type=5 "Make it easy for customers and partner users to log in to an off-platform app with the Headless Passwordless Login Flow. With this flow, users log in by entering their email address or phone number and verifying their identity with a one-time password (OTP). You control the front-end experience in your app. On the backend, your app calls Headless Passwordless Login API via an Experience Cloud site to log the user in. These steps show you how the flow works with a public client, like a single-page app, that can’t keep information private.") 2. [Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_passwordless_login_private_clients.htm&release=264.0.0&type=5 "To simplify the login process for your off-platform app, configure the Headless Passwordless Login Flow. Users log in to your app by entering their email address or phone number and verifying their identity with a one-time password (OTP). On the front end, you control the user experience in your app. On the backend, your app calls Headless Passwordless Login API via an Experience Cloud site to log the user in. These steps show you how the flow works with a private client, like a traditional client-server app, that can keep information confidential.") 5. Optionally, if your flow uses email verification, [customize the email that users receive with their one-time password](https://help.salesforce.com/s/articleView?id=experience.networks_one_time_password_email.htm&type=5&language=en_US) (OTP). ## Headless Forgot Password Allow users to reset their password on your app using the Headless Identity API for the Headless Forgot Password Flow. With this flow, a user who has forgotten their password can verify their identity and create a new password without ever leaving the branded experience of your app. 1. [Complete prerequisites for Headless Identity](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_prerequisites.htm&release=264.0.0&type=5 "Before you get started with a Headless Identity implementation for your off-platform apps, cross off these prerequisites in Salesforce."). 2. Create an [OAuth-enabled connected app to integrate your off-platform app with Salesforce APIs](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&type=5&language=en_US). 3. Configure [Experience Cloud settings for the Headless Forgot Password Flow](https://help.salesforce.com/s/articleView?id=xcloud.configure_headless_forgot_password_flow.htm&type=5&language=en_US). 4. [Build the flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_forgot_password_flow.htm&release=264.0.0&type=5 "Set up a headless password reset process on your app using the Headless Forgot Password Flow, which calls Headless Forgot Password API. Use this flow along with other headless flows to provide native identity experiences. With this flow, a user who has forgotten their password can verify their identity and create a password without ever leaving the branded experience of your app."). These instructions apply to public and private clients. ## Headless Guest Flow To set up the Headless Guest Flow, complete these steps. 1. [Complete prerequisites for Headless Identity](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_prerequisites.htm&release=264.0.0&type=5 "Before you get started with a Headless Identity implementation for your off-platform apps, cross off these prerequisites in Salesforce."). 2. Set up a [connected app for the Authorization Code and Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.authorization_code_credentials_configure.htm&type=5&language=en_US). Make sure you configure the additional settings for the guest flow. 3. Enable your connected app to issue JSON Web Token (JWT)-based access tokens. 4. Build the flow based on your app type. - [Public Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_guest_public_clients.htm&release=264.0.0&type=5 "Some users interact with your off-platform app but don’t log in or register. You can issue identifiers in the form of unique visitor ID (UVIDs) for these unknown visitors with the Headless Guest Flow. If the user decides to log in or register, you can pass the identifier into a named user flow, like a headless login flow. Use guest user identity as a tool for carrying context from guest user sessions to named user sessions. This flow is a variation of the Authorization Code and Credentials Flow.") - [Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_guest_private_client.htm&release=264.0.0&type=5 "For users who interact with your off-platform app but aren’t necessarily logged in, you can use the Headless Guest Flow to identify users with a unique visitor ID (UVID). When the user logs in or registers, you can carry the UVID forward and maintain any contextual information associated with it, like a user’s preferences. This flow is a variation of the Authorization Code and Credentials Flow.") 5. Optionally, [extend the guest user flow into a named user flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_guest_extension.htm&release=264.0.0&type=5 "When you complete a headless guest flow in your off-platform app, you get a guest JWT-based access token with the user’s unique visitor ID (UVID) minted into it. To bring the UVID and all of its associated context into a named user session, you can pass the UVID into a new authorization flow, like a headless login or registration flow."). To pass the UVID into a named user flow, the connected app used in the named user flow must be configured to issue JWT-based access tokens.