--- schema_version: "1" id: a46d09ee48d32340f20b9bc6575aa3427dcf3af32efdbb6ed6f0ce62eb0eac65 title: OAuth 2.0 DPoP Supported Flows and Endpoints collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_dpop_supported_flows.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_dpop_supported_flows.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 53843f8a7a6526913ec4119b30548f487bc841896fc1b75662759ba4d92e765c description: The OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) extension protects access to your Salesforce data. It works by cryptographically binding OAuth access and refresh tokens to the client that requested them. Even if an attacker gets access to a token, they can’t use it to access your data. You can use DPoP with most OAuth flows, and you can use DPoP-bound access tokens to request access to Salesforce resources for supported endpoints. products: - Security - Cross Cloud release: "264" --- # OAuth 2.0 DPoP Supported Flows and Endpoints The OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) extension protects access to your Salesforce data. It works by cryptographically binding OAuth access and refresh tokens to the client that requested them. Even if an attacker gets access to a token, they can’t use it to access your data. You can use DPoP with most OAuth flows, and you can use DPoP-bound access tokens to request access to Salesforce resources for supported endpoints. ### Required Editions
Available in: all editions
## OAuth Flows These OAuth 2.0 flows support DPoP: - [Client credentials flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&release=264.0.0&type=5 "Sometimes you want to directly share information between two applications without a user getting in the way. For these scenarios, you can use the OAuth 2.0 client credentials flow. In this flow, the client app exchanges its client credentials defined in the external client app—its consumer key and consumer secret—for an access token. This flow eliminates the need for explicit user interaction, though it does require you to specify an integration user to run the integration. You can use this flow as a more secure alternative to the OAuth 2.0 username-password flow.") - [Device flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_device_flow.htm&release=264.0.0&type=5 "To integrate apps that run on devices with limited input or display capabilities, such as Smart TVs, appliances, and other IoT devices, use the OAuth 2.0 device flow. Command-line apps can also use this flow. Users can connect these apps to Salesforce by accessing a browser on a device with more advanced input capabilities, such as a desktop or mobile device.") - [Headless login, registration, passwordless login, and guest flows](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_flows_parent.htm&release=264.0.0&type=5 "After you complete your setup in Salesforce, build headless identity flows that integrate your off-platform app with Headless Identity APIs.") - [Hybrid web-server](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_web_server_flow.htm&release=264.0.0&type=5 "Use the OAuth 2.0 hybrid web server flow to give hybrid apps direct management of web sessions. When the authorizing server grants an access token, it includes session IDs (SID) for the requested domains in its response. The hybrid app can then set Lightning, Visualforce, and content domain cookies and bridge an access token into a web session, providing uninterrupted service.") and [hybrid refresh token](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow.htm&release=264.0.0&type=5 "Use the OAuth 2.0 hybrid app refresh token flow to give hybrid apps direct management of web sessions after an initial session expires. When the authorizing server grants a new access token using the hybrid_refresh grant type, it includes the session IDs (SID) of the requested domains in its response. The hybrid app can set Lightning, Visualforce, and content domain cookies and use frontdoor.jsp to bridge the access token into a web session, providing uninterrupted service. The hybrid app refresh token flow renews access tokens issued by the OAuth 2.0 web server, user-agent, and hybrid app token flow.") flows - [JWT bearer flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&release=264.0.0&type=5 "Sometimes you want to authorize servers to access data without interactively logging in each time the servers exchange information. For these cases, you can use the OAuth 2.0 JSON Web Token (JWT) bearer flow. This flow uses a certificate to sign the JWT request and doesn’t require explicit user interaction. However, this flow does require prior approval of the client app.") - [Refresh token flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_refresh_token_flow.htm&release=264.0.0&type=5 "The OAuth 2.0 refresh token flow renews access tokens issued by the OAuth 2.0 web server flow or the OAuth 2.0 user-agent flow.") - [SAML bearer assertion flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_SAML_bearer_flow.htm&release=264.0.0&type=5 "With the OAuth 2.0 SAML bearer assertion flow, a client—via a connected app—can use previous authorization by supplying a signed SAML 2.0 assertion to request an OAuth access token. The digital signature applied to the SAML assertion authenticates the authorized app. A SAML assertion is an XML security token issued by an identity provider and consumed by a service provider. The service provider relies on its content to identify the assertion’s subject for security-related purposes.") - [Token exchange flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_overview.htm&release=264.0.0&type=5 "When Salesforce is just one component of an architecture that includes a central identity provider along with multiple apps and microservices, use the OAuth 2.0 token exchange flow to simplify your integration patterns. With this flow, exchange tokens from external identity providers for Salesforce tokens and grant access to Salesforce data.") - [Web-server flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&release=264.0.0&type=5 "To integrate an external web app with the Salesforce API, use the OAuth 2.0 web server flow, which implements the OAuth 2.0 authorization code grant type. With this flow, the server hosting the web app must be able to protect the external client app’s identity, defined by the client ID and client secret.") All other OAuth flows, including the username-password, user-agent, and hybrid user-agent flows, aren’t supported. ## Endpoints Salesforce supports DPoP for My Domain and Experience Cloud sites. You can use DPoP-bound access tokens to access these endpoints: - [Apex REST](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_intro.htm) - [Apex SOAP web services](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_web_services.htm) - [Bulk API 2.0 and Bulk API](https://developer.salesforce.com/docs/platform/api-asynch/guide/asynch-api-intro.html) - [Composite API](https://developer.salesforce.com/docs/platform/api-rest/guide/resources-composite-composite.html) - [Connect REST API](https://developer.salesforce.com/docs/platform/connect-rest-api/guide/intro_what_is_chatter_connect.html) - [Metadata API](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_intro.htm) - [REST API](https://developer.salesforce.com/docs/platform/api-rest/guide/intro-rest-resources.html) - [SOAP API](https://developer.salesforce.com/docs/platform/api/guide/sforce-api-quickstart-intro.html) - [SCIM endpoints](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&type=5&language=en_US) - [Tooling API](https://developer.salesforce.com/docs/atlas.en-us.api_tooling.meta/api_tooling/intro_api_tooling.htm)