--- schema_version: "1" id: 32522ea2d7974a9b5e6f1aca170cf44a82e342635df9bf9f1f8edab6adeaec9f title: Configure Experience Cloud Settings for Headless Passwordless Login collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/headless_passwordless_login_settings.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.headless_passwordless_login_settings.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 435038a5e3c26ececcab9b5c5210ce20472f78c2b73079fb605cc0a31f79c928 description: Before you build the Headless Passwordless Login Flow, configure these settings for security and access. products: - Security - Cross Cloud release: "264" --- # Configure Experience Cloud Settings for Headless Passwordless Login Before you build the Headless Passwordless Login Flow, configure these settings for security and access. ### Required Editions
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: Enterprise, Unlimited, and Developer Editions
Before configuring these settings, complete these steps. - [Complete prerequisites for Headless Identity](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_prerequisites.htm&release=264.0.0&type=5 "Before you get started with a Headless Identity implementation for your off-platform apps, cross off these prerequisites in Salesforce."). - [Setup a connected app for the Authorization Code and Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.authorization_code_credentials_configure.htm&type=5&language=en_US). For security, you must configure Salesforce to require either authentication or reCAPTCHA for your app’s initial request to Headless Passwordless Login API. Your security best practices depend on whether your app is a private client or a public client. If you’re implementing the flow with a private client, like a traditional client-server app with its own private backend, we recommend that you always require authentication. With this requirement, when your app submits information to the headless passwordless login endpoint, you must include an access token. To get the access token, use an internal integration user to complete an OAuth flow integrated with Salesforce, like the OAuth 2.0 web server flow. Include the `pwdless_login_api` scope when you complete this flow, either by configuring it in your connected app or passing it as a parameter. For a public client that can’t securely store information, like a single-page app, we recommend that you always require reCAPTCHA. With this requirement, you must include a reCAPTCHA token in POST requests when your app submits user information to Headless Passwordless Login API. To get a reCAPTCHA token, implement reCAPTCHA on your third-party app. For more information, see the reCAPTCHA documentation provided by [Google](https://developers.google.com/recaptcha). Salesforce supports these reCAPTCHA versions: v2, v3, and Enterprise. For a public client, we never recommend requiring authentication because the app can’t keep the access token secure. To expand your email template options for the one-time password (OTP) email sent to end users during the flow, opt in to email template allowlisting and create an allowlist with custom templates. See [Use Multiple Email Templates for Headless Flows](https://help.salesforce.com/s/articleView?id=sf.headless_identity_email_template_allowlist.htm&language=en_US). 1. From Setup, in the Quick Find box, enter Sites, and then select **All Sites**. 2. To access Experience Workspaces, next to your site name, click **Workspaces**. 3. Select **Administration**, and then select **Login & Registration**. 4. From the Administration workspace, select **Login & Registration**. 5. Under Headless Passwordless Login, select **Allow login via the Headless Passwordless Login API**. 6. To require an access token when your app submits information to Headless Passwordless Login API, select **Require authentication to access this API**. 7. To require a reCAPTCHA token when your app submits user information to Headless Passwordless Login API, select **Require reCAPTCHA to access this API**. 8. If you selected **Require reCAPTCHA to access this API**, configure reCAPTCHA settings. 1. For Secret Key, enter the key from your reCAPTCHA API key pair. 2. For Score Threshold, enter a threshold value between 0.5 and 1. If you’re using reCAPTCHA v3, this value determines the score that you accept. Scores closer to 0.5 are more likely to be bots, while scores closer to 1 are more likely to be valid users. For more information, see the [reCAPTCHA v3 documentation](https://developers.google.com/recaptcha/docs/v3). ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png) Note If you require reCAPTCHA for other Headless Identity flows, like registration and forgot password, these settings also apply. 9. To use a headless user discovery handler to look up users, take these steps. 1. For User Discovery Handler, click ![Magnifying glass icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/lookup.png) and select an Apex class that implements the `Auth.HeadlessUserDiscoveryHandler` interface. Or, to generate a template class, click **Create a headless user discovery handler template** and customize the code later. 2. For Run As, select a user to run the handler. We recommend that you use an integration user account instead of a real user. 10. Save your settings. 11. Optionally, customize the OTP email that’s sent to end users for verification. If you created an email template allowlist, Salesforce defaults to this email template if you don’t include an `emailtemplate` parameter in your request. 1. From the Administration workspace, select **Emails**. 2. For One-Time Password, click ![Magnifying glass icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/lookup.png). 3. In the window that appears, select **Experience Cloud: One-Time Password Email**. 4. Save your changes. 5. To customize the email, [edit its default content](https://help.salesforce.com/s/articleView?id=experience.networks_one_time_password_email.htm&type=5&language=en_US). You’re now ready to implement the Headless Passwordless Login Flow. Check out the instructions for your app type. - [Public Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_passwordless_login_public_clients.htm&release=264.0.0&type=5 "Make it easy for customers and partner users to log in to an off-platform app with the Headless Passwordless Login Flow. With this flow, users log in by entering their email address or phone number and verifying their identity with a one-time password (OTP). You control the front-end experience in your app. On the backend, your app calls Headless Passwordless Login API via an Experience Cloud site to log the user in. These steps show you how the flow works with a public client, like a single-page app, that can’t keep information private.") - [Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_passwordless_login_private_clients.htm&release=264.0.0&type=5 "To simplify the login process for your off-platform app, configure the Headless Passwordless Login Flow. Users log in to your app by entering their email address or phone number and verifying their identity with a one-time password (OTP). On the front end, you control the user experience in your app. On the backend, your app calls Headless Passwordless Login API via an Experience Cloud site to log the user in. These steps show you how the flow works with a private client, like a traditional client-server app, that can keep information confidential.")