--- schema_version: "1" id: 329ecbb653811c2bafd0ab915fa7c0bca7a001b554d37c4fcfe2cd556494ac01 title: Configure Experience Cloud Settings for Headless Registration collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/headless_identity_registration_settings.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_registration_settings.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 32e93f96eb335cc52c6e205085bf118f69dde12f9e545a724a36c137178d9dec description: Before you set up the Headless Registration Flow, configure settings to control security and access for your app. products: - Security - Cross Cloud release: "264" --- # Configure Experience Cloud Settings for Headless Registration Before you set up the Headless Registration Flow, configure settings to control security and access for your app. ### Required Editions
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: Enterprise, Unlimited, and Developer Editions
Before you configure your Experience Cloud settings, complete these tasks. - [Complete Prerequisites for Headless Identity](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_prerequisites.htm&type=5&language=en_US). - [Configure a Connected App for the Authorization Code and Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.authorization_code_credentials_configure.htm&type=5&language=en_US). This flow is the foundation of the Headless Registration Flow. Depending on your use case, there are a few considerations before you configure these settings. For security, you must configure Salesforce to require either authentication or reCAPTCHA when your app submits user information to Headless Registration API. If you’re implementing the flow with a private client—also known as a web app with a backing server—we recommend that you always require authentication. With this requirement, when your app submits user information to the headless registration endpoint, you must include an access token issued to an integration user. To get the access token, use an internal integration user to complete an OAuth flow integrated with Salesforce, like the OAuth 2.0 web server flow. Make sure that you include the `user_registration_api` scope when you complete this flow, either by configuring it on your connected app or passing it as a parameter. Save the access token from your response. If you’re using the flow with a public client—also known as a single-page app—we recommend that you always reCAPTCHA. With this requirement, you must include a reCAPTCHA token in POST requests when your app submits user information to the Headless Registration API. To get a reCAPTCHA token, implement reCAPTCHA on your third-party app. For more information, see the reCAPTCHA documentation provided by [Google](https://developers.google.com/recaptcha). We recommend that you never require authentication for public clients because they can’t keep the access token secret. To expand your email template options for the one-time password (OTP) email sent to end users during the flow, opt in to email template allowlisting and create an allowlist with custom templates. See [Use Multiple Email Templates for Headless Flows](https://help.salesforce.com/s/articleView?id=sf.headless_identity_email_template_allowlist.htm&language=en_US). 1. From Setup, in the Quick Find box, enter Sites, and then select **All Sites**. 2. To access Experience Workspaces, next to your site name, click **Workspaces**. 3. Select **Administration**, and then select **Login & Registration**. 4. From the Administration workspace, select **Login & Registration**. 5. Under Headless Identity Configuration, select **Allow self-registration via the Headless Registration API**. 6. To require an access token when your app submits user information to the Headless Registration API, select **Require authentication to access this API**. If you select this option, you must include an access token issued to an internal integration user in your POST request to the `init/registration` endpoint. Include the access token in a Basic authorization header. The access token must contain the `user_registration_api` scope. 7. To require a reCAPTCHA token when your app submits user information to the Headless Registration API, select **Require reCAPTCHA to access this API**. If you select this option, you must include a reCAPTCHA token in your POST request to the `init/registration` endpoint. If you’re implementing headless registration with a public client, select this setting. 8. For Default Profile, select the profile that you want to assign to new users when they register. 9. For Registration Handler, click ![Lookup](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/lookup.png), and then select an Apex class that implements the `HeadlessRegistrationHandler` interface. Or, to automatically create a template, select **Create a headless registration handler template**. The template is created when you save your changes. Edit its default content from Apex Classes in Setup. For more information about creating a headless registration handler or editing the default handler, see [HeadlessSelfRegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_HeadlessSelfRegistrationHandler.htm) in the Apex Reference Guide. 10. For Run As, select an execution user for the registration handler. 11. If you selected **Require reCAPTCHA to access this API**, configure reCAPTCHA settings. 1. For Secret Key, enter the key from your reCAPTCHA API key pair. 2. For Score Threshold, enter a threshold value between 0.5 and 1. If you’re using reCAPTCHA v3, this value determines the score that you accept. Scores closer to 0.5 are more likely to be bots, while scores closer to 1 are more likely to be valid users. For more information, see the [reCAPTCHA v3 documentation](https://developers.google.com/recaptcha/docs/v3). ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png) Note If you require reCAPTCHA for other Headless Identity flows, like forgot password and passwordless login, these settings also apply. 12. Save your settings. 13. Optionally, configure an email template. If you created an email template allowlist, Salesforce defaults to this email template if you don’t include an `emailtemplate` parameter in your request. 1. From the Administration workspace, select **Emails**. 2. For One-Time Password for Headless Registration, click ![Lookup](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/lookup.png). 3. In the popup window that appears, select **Experience Cloud: One-Time Password Email for Headless Registration Verification**. 4. Save your changes. 5. To customize the email, [edit its default content](https://help.salesforce.com/s/articleView?id=experience.networks_headless_registration_email.htm&type=5&language=en_US). Configure the Headless Registration Flow using the instructions for your app type. - [Public Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_registration_public_clients.htm&release=264.0.0&type=5 "For apps that can’t keep confidential information, such as single-page apps, you can set up headless registration for customers and partners using the Headless Registration Flow. The Headless Registration Flow extends the Authorization Code and Credentials Flow, which is built on the OAuth 2.0 Authorization Code grant type. With this flow, you control the front-end user registration experience in a third-party app. You call Salesforce Headless Registration API via your Experience Cloud site to create users, log them in, and give them access to Salesforce resources. By separating these two processes, your users can register for your app and access Salesforce data without leaving the app.") - [Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_registration_private_clients.htm&release=264.0.0&type=5 "For apps that are able to keep confidential information, such as web apps with a client-server architecture, you can set up headless registration for customers and partners using the Headless Registration Flow. The Headless Registration Flow extends the Authorization Code and Credentials Flow, which is built on the OAuth 2.0 Authorization Code grant type. With this flow, you control the front-end user registration experience in a third-party app. You call Salesforce Headless Registration API via your Experience Cloud site to create users, log them in, and give them access to Salesforce resources. By separating these two processes, your users can register for your app and access Salesforce data without leaving the app.")