---
schema_version: "1"
id: 9389897d991483cb0d75dada91d46ab463cc93d84859d24b2da709c3c6b8d960
title: "OAuth 2.0 for First-Party Applications: Configure Experience Cloud Settings"
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_auth_challenge_experience_settings.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_auth_challenge_experience_settings.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 782df589c21fbf9015b452d0f0f733b5d248c379277ce0e0ca1582dbebd0d4a3
description: Before you build headless username-password login, passwordless login, and registration flows using the OAuth 2.0 for First-Party Applications draft protocol, configure Experience Cloud settings on the Login & Registration page.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 for First-Party Applications: Configure Experience Cloud Settings

Before you build headless username-password login, passwordless login, and registration flows using the OAuth 2.0 for First-Party Applications draft protocol, configure Experience Cloud settings on the Login & Registration page.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

## Headless Username-Password Login

Configure settings for headless username-password login via the authorization challenge endpoint.

1. From Setup, in the Quick Find box, enter Sites, and then select **All Sites**.
2. To access Experience Workspaces, next to your site name, click **Workspaces**.
3. Select **Administration**, and then select **Login & Registration**.
4. Under OAuth 2.0 for First-Party Applications, select **Allow off-platform apps to access the OAuth 2.0 authorization challenge endpoint**.
5. To require a reCAPTCHA token when your app submits user information to the authorization challenge endpoint, select **Require reCAPTCHA to access the OAuth 2.0 authorization challenge endpoint for username-password login authorization flows**.
6. If you opted to require reCAPTCHA, scroll down to reCAPTCHA Options for Headless Identity and configure reCAPTCHA settings.
    
    1. For Secret Key, enter the key from your reCAPTCHA API key pair.
    2. For Score Threshold, enter a threshold value between 0.5 and 1.
        
        If you’re using reCAPTCHA v3, this value determines the score that you accept. Scores closer to 0.5 are more likely to be bots, while scores closer to 1 are more likely to be valid users. For more information, see the [reCAPTCHA v3 documentation](https://developers.google.com/recaptcha/docs/v3).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note If you require reCAPTCHA for other headless identity flows, these settings also apply.
7. Save your settings.

## Headless Passwordless Login

Configure settings for headless passwordless login via the authorization challenge endpoint.

1. From Setup, in the Quick Find box, enter Sites, and then select **All Sites**.
2. To access Experience Workspaces, next to your site name, click **Workspaces**.
3. Select **Administration**, and then select **Login & Registration**.
4. Under OAuth 2.0 for First-Party Applications, select **Allow off-platform apps to access the OAuth 2.0 authorization challenge endpoint**.
5. Under Headless Passwordless Login, select **Allow login via the Headless Passwordless Login API**.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note This setting is required for headless passwordless login even if you don't make any calls to the services/auth/headless/init/passwordless/login endpoint.
6. To require an access token in your initial request to the authorization challenge endpoint, select **Require authentication to access this API**.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note Passwordless login via the authorization challenge endpoint always requires a client attestation JWT in your initial call, so it isn't necessary to send an access token. But you can include it if you want.
7. To require a reCAPTCHA token in your initial request to the authorization challenge endpoint, select **Require reCAPTCHA to access this API**.
8. If you opted to require reCAPTCHA, scroll down to reCAPTCHA Options for Headless Identity and configure reCAPTCHA settings.
    
    1. For Secret Key, enter the key from your reCAPTCHA API key pair.
    2. For Score Threshold, enter a threshold value between 0.5 and 1.
        
        If you’re using reCAPTCHA v3, this value determines the score that you accept. Scores closer to 0.5 are more likely to be bots, while scores closer to 1 are more likely to be valid users. For more information, see the [reCAPTCHA v3 documentation](https://developers.google.com/recaptcha/docs/v3).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note If you require reCAPTCHA for other headless identity flows, these settings also apply.
9. Save your settings.
10. Optionally, customize the OTP email that’s sent to end users for verification. If you created an email template allowlist, Salesforce defaults to this email template if you don’t include an `emailtemplate` parameter in your request.
    1. From the Administration workspace, select **Emails**.
    2. For One-Time Password, click ![Magnifying glass icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/lookup.png).
    3. In the window that appears, select **Experience Cloud: One-Time Password Email**.
    4. Save your changes.
    5. To customize the email, [edit its default content](https://help.salesforce.com/s/articleView?id=experience.networks_one_time_password_email.htm&type=5&language=en_US).

## Headless Registration

Configure settings for headless passwordless login via the authorization challenge endpoint.

1. From Setup, in the Quick Find box, enter Sites, and then select **All Sites**.
2. To access Experience Workspaces, next to your site name, click **Workspaces**.
3. Select **Administration**, and then select **Login & Registration**.
4. Under OAuth 2.0 for First-Party Applications, select **Allow off-platform apps to access the OAuth 2.0 authorization challenge endpoint**.
5. Under Headless Registration, select **Allow self-registration via the Headless Registration API**.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note This setting is required for headless passwordless login even if you don't make any calls to the /services/auth/headless/init/registration endpoint.
6. To require an access token in your initial request to the authorization challenge endpoint, select **Require authentication to access this API**.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note Headless registration via the authorization challenge endpoint always requires a client attestation JWT in your initial call, so it isn't necessary to send an access token. But you can include it if you want.
7. To require a reCAPTCHA token in your initial request to the authorization challenge endpoint, select **Require reCAPTCHA to access this API**.
8. If you opted to require reCAPTCHA, scroll down to reCAPTCHA Options for Headless Identity and configure reCAPTCHA settings.
    
    1. For Secret Key, enter the key from your reCAPTCHA API key pair.
    2. For Score Threshold, enter a threshold value between 0.5 and 1.
        
        If you’re using reCAPTCHA v3, this value determines the score that you accept. Scores closer to 0.5 are more likely to be bots, while scores closer to 1 are more likely to be valid users. For more information, see the [reCAPTCHA v3 documentation](https://developers.google.com/recaptcha/docs/v3).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note If you require reCAPTCHA for other headless identity flows, these settings also apply.
9. Save your settings.
10. Optionally, customize the OTP email that’s sent to end users for verification. If you created an email template allowlist, Salesforce defaults to this email template if you don’t include an `emailtemplate` parameter in your request.
    1. From the Administration workspace, select **Emails**.
    2. For One-Time Password, click ![Magnifying glass icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/lookup.png).
    3. In the window that appears, select **Experience Cloud: One-Time Password Email**.
    4. Save your changes.
    5. To customize the email, [edit its default content](https://help.salesforce.com/s/articleView?id=experience.networks_one_time_password_email.htm&type=5&language=en_US).