---
schema_version: "1"
id: e0a789cb58c70c43be046c5d3379237e6022f1ed2e7d87076dd633f81095f68f
title: Configure Headless Identity Flows with OAuth 2.0 for First-Party Applications
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_headless_identity_auth_challenge_parent.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_identity_auth_challenge_parent.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a0ae86dd87f40b0c93711bba7f1f238a1ed45a4892cba45058a69f71b1c1074e
description: After you complete your setup in Salesforce, build headless identity flows that integrate your off-platform app using the OAuth 2.0 for First-Party Applications draft protocol.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure Headless Identity Flows with OAuth 2.0 for First-Party Applications

After you complete your setup in Salesforce, build headless identity flows that integrate your off-platform app using the OAuth 2.0 for First-Party Applications draft protocol.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

- **[OAuth 2.0 for First-Party Applications: Generate a Client Attestation JWT](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_auth_challenge_generate_jwt.htm&release=264.0.0&type=5)**  
    When using headless identity flows that implement the OAuth 2.0 for First-Party Applications draft standard, use a client attestation JWT to prove that apps sending requests to Salesforce are first-party apps created by your company.
- **[OAuth 2.0 for First-Party Applications: Headless Username-Password Flow for Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_auth_challenge_username_password.htm&release=264.0.0&type=5)**  
    To set up username-password login for an off-platform app developed by your company, use this headless username-password login flow, which implements the OAuth 2.0 for First-Party Applications draft standard protocol. With this flow, you can entirely control the front-end login experience in your first-party app while Salesforce handles the backend work of authenticating users and granting access to protected resources. This flow is supported only for private clients, such as client-server apps, and is supported only for external users
- **[OAuth 2.0 for First-Party Applications: Headless Passwordless Login for Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_auth_challenge_passwordless_login.htm&release=264.0.0&type=5)**  
    With headless passwordless login, users log in to your off-platform app via their email address or phone number and a one-time password. To set up passwordless login for an off-platform app developed by your company, use this headless passwordless login flow, which implements the OAuth 2.0 for First-Party Applications draft protocol. With this flow, you can entirely control the front-end login experience in your first-party app while Salesforce handles the backend work of authenticating users and granting access to protected resources. This flow is supported only for private clients, such as client-server apps, and is supported only for external users.
- **[OAuth 2.0 for First-Party Applications: Headless Registration Flow for Private Clients](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_auth_challenge_registration.htm&release=264.0.0&type=5)**  
    To set up a headless user registration process for an off-platform app developed by your company, use this flow, which implements the OAuth 2.0 for First-Party Applications draft standard protocol. This flow is supported only for private clients, such as client-server apps. With this flow, you can entirely control the front-end registration experience in your first-party app while Salesforce handles the backend work of authenticating users and granting access to protected resources. This flow is supported only for private clients, such as client-server apps, and is supported only for external users.