--- schema_version: "1" id: 6fd5592f25007d94ad69bb6f75984f6c6a58207b09b426eedc1d8aeb04bcabee title: OAuth Endpoints collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_endpoints.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_endpoints.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 8c4caa8d13a2a4acf58b9fb4ac12117aac39a9569a023ceb1c977b595227e107 description: OAuth endpoints are the URLs that you use to make OAuth authorization requests to Salesforce. Each OAuth flow defines which endpoints to use and what request data to provide. products: - Security - Cross Cloud release: "264" --- # OAuth Endpoints OAuth endpoints are the URLs that you use to make OAuth authorization requests to Salesforce. Each OAuth flow defines which endpoints to use and what request data to provide. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: All Editions
Use these OAuth endpoints for your OAuth authorization requests. If indicated, the OAuth endpoints support Cross-Origin Resource Sharing (CORS). For information about support for CORS with certain OAuth endpoints, see [Enable CORS for OAuth Endpoints](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_endpoints_cors.htm&release=264.0.0&type=5 "Web applications use Cross-Origin Resource Sharing (CORS) to request resources from origins other than their own. For example, a web page can use CORS to request information about a user from your My Domain login URL or Experience Cloud site URL. In addition to public and allowlisted web pages, Salesforce supports CORS for certain OAuth endpoints when requested from a My Domain login URL or Experience Cloud site URL."). All OAuth endpoints require secure HTTP (HTTPS). For standard OAuth 2.0 authorization flows, these host domains are supported unless otherwise specified. - login.salesforce.com - A My Domain URL, such as https://MyCompany.my.salesforce.com - An Experience Cloud site URL, such as https://MyDomainName.my.site.com - A custom URL - For sandboxes, use test.salesforce.com or the My Domain login URL for the sandbox, such as MyDomainName--SandboxName.sandbox.my.salesforce.com. If you’re calling an endpoint during a headless identity authorization flow, the only supported host domains are Experience Cloud site URLs. | OAuth Endpoint | Description | CORS Allowed | | --- | --- | --- | | `https://hostname/services/oauth2/authorize` | The Salesforce instance’s OAuth 2.0 authorization endpoint. External client apps send OAuth authorization requests to this endpoint during standard OAuth 2.0 authorization flows and headless identity flows | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/oauth2/token` | The Salesforce instance’s OAuth 2.0 token endpoint. External client apps send OAuth token requests to this endpoint during standard OAuth 2.0 authorization flows and headless identity flows. | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/auth/headless/init/registration` | The Salesforce instance’s Headless Registration API endpoint. A headless client app sends requests to this endpoint to initialize headless registration. This endpoint supports only headless identity flows, so hostname must be an Experience Cloud site URL. | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/auth/headless/init/passwordless/login` | The Salesforce instance’s Headless Passwordless Login API endpoint. A headless client app sends requests to this endpoint to initialize headless passwordless login. This endpoint supports only headless identity flows, so the hostname must be an Experience Cloud site URL. | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/auth/headless/forgot_password` | The Salesforce instance’s Headless Forgot Password API endpoint. A headless client app sends requests to this endpoint during a headless password reset process. This endpoint supports only headless identity flows, so the hostname must be an Experience Cloud site URL. | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/oauth2/revoke` | The Salesforce instance’s OAuth 2.0 revoke endpoint. Send requests to this endpoint to revoke an external client app’s access during a standard authorization flow or headless identity flow. See [Revoke OAuth Tokens](https://help.salesforce.com/articleView?id=remoteaccess_revoke_token.htm&language=en_US). | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/oauth2/userinfo` | The OpenID Connect OAuth 2.0 user profile information endpoint. OpenID Connect defines the UserInfo endpoint to get a user’s profile information. See [Query for User Information](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_using_userinfo_endpoint.htm&release=264.0.0&type=5 "A connected app can query the UserInfo endpoint for information about the user associated with the connected app’s access token. Salesforce returns basic personal information about the user and important endpoints that the connected app can talk to, such as photos and accessible API endpoints. This UserInfo endpoint provides access to information only for the current user. It doesn’t give access to other users in the org."). | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/oauth2/register` | The OpenID Connect dynamic client registration endpoint. Send requests to this endpoint to automatically register external client apps with Salesforce. See [OpenID Connect Dynamic Client Registration for External API Gateways](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_dynamic_client_reg_flow.htm&release=264.0.0&type=5 "Although not a typical authorization flow, you can use OpenID Connect dynamic client registration to enable your Salesforce instance as an independent OAuth authorization server to protect resources hosted on an external API gateway."). |   | | `https://hostname/services/oauth2/introspect` | The OpenID Connect token introspection endpoint. Send requests to this endpoint to check the current state of an OAuth 2.0 access or refresh token. See [OpenID Connect Token Introspection](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_token_introspection_endpoint.htm&release=264.0.0&type=5 "As part of the authorization process, token introspection allows all OAuth connected apps to check the current state of an OAuth 2.0 access or refresh token. The resource server or connected apps send the client app’s client ID and secret to the authorization server, initiating an OAuth authorization flow. As part of this flow, the authorization server validates, or introspects, the client app’s access token. If the access token is current and valid, the client app is granted access."). | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/.well-known/openid-configuration` | The OpenID Connect discovery endpoint. Send queries to this endpoint for information about the Salesforce OpenID Connect configuration. See [Query for the OpenID Connect Configuration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_using_openid_discovery_endpoint.htm&release=264.0.0&type=5 "Use the OpenID Connect discovery endpoint to query for information about the Salesforce OpenID Connect configuration. Salesforce returns basic information about endpoints, supported scopes, and other values used for OpenID Connect authorization."). | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/.well-known/auth-configuration` | The authentication configuration endpoint. Send queries to this endpoint for information about an org’s SAML single sign-on and authentication provider settings. See [Query SAML Authentication Settings](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_auth_configuration_endpoint.htm&release=264.0.0&type=5 "You can query the authentication configuration endpoint for information about an org's or Experience Cloud site's SAML single sign-on (SSO) and authentication provider settings. Use this functionality when you’re developing apps that need this information on demand."). | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | | `https://hostname/services/oauth2/pkce/generator` | The Proof Key for Code Exchange (PKCE) Generator endpoint. Send requests to this endpoint to generate parameters that you can use to implement the PKCE security extension for variations of the authorization code flow. See [Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&release=264.0.0&type=5 "To improve the security of your OAuth and authentication provider implementations, use the OAuth 2.0 Proof Key for Code Exchange (PKCE) extension. You can require PKCE at an org-wide level, require it for a specific connected app, and automatically enable it for supported authentication providers."). For standard OAuth flows, the `hostname` must be a My Domain login URL or Experience Cloud site URL. For headless identity flows, use the Experience Cloud site URL. | ![Checkmark](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) |