---
schema_version: "1"
id: 67e792ba545ab0fd85a9c60b9f49e852f841b26a3a989e7c74e1cfcf4e32aa96
title: OAuth 2.0 Hybrid App Refresh Token Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_hybrid_app_refresh_token_flow.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 54484d13e05c2e544ccea9de670778538c6c6bd20cdd3bdc99e07b246b1e1202
description: Use the OAuth 2.0 hybrid app refresh token flow to give hybrid apps direct management of web sessions after an initial session expires. When the authorizing server grants a new access token using the hybrid_refresh grant type, it includes the session IDs (SID) of the requested domains in its response. The hybrid app can set Lightning, Visualforce, and content domain cookies and use frontdoor.jsp to bridge the access token into a web session, providing uninterrupted service. The hybrid app refresh token flow renews access tokens issued by the OAuth 2.0 web server, user-agent, and hybrid app token flow.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 Hybrid App Refresh Token Flow

Use the OAuth 2.0 hybrid app refresh token flow to give hybrid apps direct management of web sessions after an initial session expires. When the authorizing server grants a new access token using the hybrid\_refresh grant type, it includes the session IDs (SID) of the requested domains in its response. The hybrid app can set Lightning, Visualforce, and content domain cookies and use frontdoor.jsp to bridge the access token into a web session, providing uninterrupted service. The hybrid app refresh token flow renews access tokens issued by the OAuth 2.0 web server, user-agent, and hybrid app token flow.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (<a href="https://help.salesforce.com/s/articleView?id=xcloud.overview_edition_lex_only.htm&amp;type=5&amp;language=en_US" target="_blank">not available in all orgs</a>) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Mobile SDK 9.1 supports OAuth 2.0 hybrid app flows.

After a hybrid app—via an external client app—receives an access token, it can use a refresh token to get a new session when its current session expires. The external client app’s session timeout value determines when an access token is no longer valid and when to apply for a new one using a refresh token.

For better security, enable refresh token rotation on your external client app when you configure its OAuth settings. With this setting enabled, the external client app issues a new refresh token along with the access token each time the flow is invoked. The previous refresh token is automatically invalidated. Refresh token rotation ensures that each refresh token is used only one time per user, so that refresh tokens can’t be used to get new access tokens. If someone tries to use a refresh token that’s been rotated out, Salesforce invalidates the current refresh token and any associated access tokens. To get a new refresh token, the client must complete a new flow.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note For the hybrid app refresh token flow, refresh token rotation is supported only if you issue opaque access tokens. If your external client app is configured to issue JWT-based access tokens, the hybrid app refresh token flow returns an `invalid_grant` error when you try to request a token.

The hybrid app refresh token flow involves these steps.

- [The app uses the existing refresh token to request a new access token.](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow.htm&release=264.0.0&type=5)
- [After verifying the request, Salesforce grants a new access token to the app.](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow.htm&release=264.0.0&type=5)
- [The app directly sets the SIDs in the domains’ session cookies and bridges a web session.](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow.htm&release=264.0.0&type=5)

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_important.png)

Important When developing OAuth integrations, always pass sensitive information in the body of a POST request or in a request header. Don't use GET parameters in the URL query string to pass sensitive information. Sensitive information includes but isn't limited to usernames, passwords, OAuth tokens, client secrets, and any personally identifiable information. For more information on security best practices, see [Storing Sensitive Data](https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_storing_sensitive_data.htm) in the Secure Coding Guide.

## Request a New Access Token

The app can use the refresh token to get a new access token by sending a refresh token POST request to the Salesforce token endpoint.

The external client app can send the `client_id` and `client_secret` in the body of the refresh token POST request, as shown here.

```
POST /services/oauth2/token HTTP/1.1
Host: login.salesforce.com/ 
grant_type=hybrid_refresh&
client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&
client_secret=1955279925675241571&
refresh_token=your token here
```

Instead of sending client credentials as parameters in the body of the refresh token POST request, you can use the HTTP Basic authentication scheme. This scheme’s format requires the `client_id` and `client_secret` in the authorization header of the post: `Authorization: Basic64Encode(client_id:secret)`.

The `client_id` and `client_secret` are separated with a colon (:). For more information, see the [OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749).

This example shows a hybrid app refresh token POST request that uses the HTTP Basic authentication scheme rather than sending client credentials in the POST request’s body.

```
POST /services/oauth2/token HTTP/1.1
Host: login.salesforce.com
Authorization:  Basic 
client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&
client_secret=1955279925675241571
grant_type=hybrid_refresh&
refresh_token=your token here
```

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note If the `client_id` and `client_secret` are sent in the POST’s body, the authorization header is ignored.

With either refresh token POST request format, include these parameters.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d4743e186">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d4743e189">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e186 ">
              <code>client_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e189 ">The consumer key of the external client app. To access the consumer key, from
              the External Client App Manager, find the external client app and select
              <strong class="uicontrol">Edit Settings</strong> from the dropdown. Then expand the OAuth
              Settings section and click <strong class="uicontrol">Consumer Key and Secret</strong>. You're
              sometimes prompted to verify your identity before you can view the consumer
              key.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e186 ">
              <code>client_secret</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e189 ">The consumer secret of the external client app. To access the consumer secret,
              from the External Client App Manager, find the external client app and select
              <strong class="uicontrol">Edit Settings</strong> from the dropdown. Then expand the OAuth
              Settings section and click <strong class="uicontrol">Consumer Key and Secret</strong>. You're
              sometimes prompted to verify your identity before you can view the consumer
              secret.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e186 ">
              <code>grant_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e189 ">The OAuth 2.0 grant type that the external client app requests. The value must
              be <code>hybrid_refresh</code> for this flow.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e186 ">
              <code>refresh_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e189 ">Token obtained from the web server, user-agent, or hybrid app token flow. This
              value is a secret. Take appropriate measures to protect it. This parameter is
              returned only if your external client app is set up with a
              <code>refresh_token</code> scope.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e186 ">
              <code>client_assertion</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e189 ">Instead of passing a <code>client_secret</code>, you
              can provide a <code>client_assertion</code> and <code>client_assertion_type</code>. If a <code>client_secret</code> parameter isn’t provided, Salesforce
              checks for the <code>client_assertion</code> and <code>client_assertion_type</code>. See <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&amp;type=5&amp;language=en_US" target="_blank">Use <code>client_assertion</code> Instead of <code>client_secret</code></a>. </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e186 ">
              <code>client_assertion_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e189 ">
              <p>Provide this value when using the <code>client_assertion</code> parameter.</p>
              <p style="margin-bottom:0;">The value of <code>client_assertion_type</code> must be <code>urn:ietf:params:oauth:client-assertion-type:jwt-bearer</code>.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e186 ">
              <code>format</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e189 ">
              <p>If not included in the request’s header, you can specify the expected return
                format. The <code>format</code> parameter takes precedence
                over the request’s header. These formats are supported.</p>
              <ul>
                <li><code>urlencoded</code></li>
                <li><code>json</code> (default)</li>
                <li><code>xml</code></li>
              </ul>
            </td>

          </tr>
        </tbody>
      </table>

## Salesforce Grants a New Access Token

After verifying the request, Salesforce sends a response with a new access token to the app. Here’s an example JSON response from Salesforce.

```
{ "id":"https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P",
"issued_at":"1278448384422",
"instance_url":"https://yourInstance.salesforce.com/",
"signature":"SSSbLO/gBhmmyNUvN18ODBDFYHzakxOMgqYtu+hDPsc=",
"access_token":"00Dx0000000BV7z!AR8AQP0jITN80ESEsj5EbaZTFG0RNBaT1cyWk7TrqoDjoNIWQ2ME_sTZzBjfmOE6zMHq6y8PIW4eWze9JksNEkWUl.Cju7m4",
"token_type":"Bearer",
"scope":"web visualforce refresh_token lightning content",
"cookie-clientSrc":"10.xxx.xx.xx",
"sidCookieName":"sid",
"cookie-sid_Client":"0000000...",
"content_domain":"MyDomainName.file.force.com",
"content_sid":"00Dxx0000006Gb…",
"lightning_domain":"MyDomainName.lightning.force.com",
"lightning_sid”:”00Dxx000000…",
"csrf_token":"ABCD…",
"visualforce_domain":"MyDomainName.vf.force.com",
"visualforce_sid":"00Dxx000000…"}
```

And here’s an example XML response.

```
<Oauth>
   <access_token>00Dx0000000BV7z!AR8AQP0jITN80ESEsj5EbaZTFG0RNB...</access_token>
   <token_type>Bearer</token_type>
   <scope>web visualforce refresh_token lightning content</scope>
   <cookie-clientSrc>10.xxx.xx.xx</cookie-clientSrc>
   <sidCookieName>sid</sidCookieName>
   <cookie-sid_Client>0000000...</cookie-sid_Client>
   <content_domain>MyDomainName.file.force.com</content_domain>
   <content_sid>00Dxx0000006Gb…</content_sid>
   <lightning_domain>MyDomainName.lightning.force.com</lightning_domain>
   <lightning_sid>00Dxx000000…</lighning_sid>
   <csrf_token>ABCD…</csrf_token>
   <visualforce_domain>MyDomainName.vf.force.com</visualforce_domain>
   <visualforce_sid>00Dxx000000…</visualforce_sid>
<instance_url>https://yourInstance.salesforce.com/</instance_url>
<id>https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P</id>
   <issued_at>1278448101416</issued_at>
   <signature>CMJ4l+CCaPQiKjoOEwEig9H4wqhpuLSk4J2urAe+fVg=</signature>
</Oauth>
```

This example shows a URL-encoded response.

```
access_token=00Dx0000000BV7z%21AR8AQP0jITN80ESEsj5E...&
token_type=Bearer&
instance_url=https%3A%2F%2FyourInstance.salesforce.com&
id=https://login.salesforce.com%2Fid%2F00Dx0000000BV7z%2F005x00000012Q9P&
issued_at=1278448101416&
signature=CMJ4l%2BCCaPQiKjoOEwEig9H4wqhpuLSk4J2...
cookie-clientSrc=10.xxx.xx.xx&
content_domain=MyDomainName.file.force.com&
content_sid=00Dxx0000006Gb...&
lightning_domain=MyDomainName.lightning.force.com&
lightning_sid=00Dxx000000...&
csrf_token=ABCD...&
visualforce_domain=MyDomainName.vf.force.com&
visualforce_sid=00Dxx000000...&
scope=web+visualforce+refresh_token+lightning+content&
sidCookieName=sid&
cookie-sid_Client=0000000...&
```

The following parameters can be included in the body of the response.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d4743e420">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d4743e423">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>access_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">OAuth token that an external client app uses to request access to a protected
              resource on behalf of the client application. Additional permissions in the form of
              scopes can accompany the access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>token_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">A <code>Bearer</code> token type, which is used for all
              responses that include an access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>instance_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">A URL indicating the instance of the user’s org. For example: <code>https://<var>yourInstance</var>.salesforce.com/</code>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">An identity URL that can be used to identify the user and to query for more
              information about the user. See <a href="https://help.salesforce.com/articleView?id=remoteaccess_using_openid.htm&amp;language=en_US" target="_blank">Identity
                URLs</a>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>issued_at</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">Time stamp of when the signature was created in milliseconds.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>signature</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">Base64-encoded HMAC-SHA256 signature signed with the <code>client_secret</code>. The signature can include the
              concatenated ID and <code>issued_at value</code>, which you
              can use to verify that the identity URL hasn’t changed since the server sent
              it.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>sfdc_site_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">If the user is a member of an Experience Cloud site, the site URL is
              provided.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>sfdc_site_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">If the user is a member of an Experience Cloud site, the user’s site ID is
              provided.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>content_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The domain of the content session, which maps to the content SID: <code><var>MyDomainName</var>.file.force.com →
                  content_sid</code>.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>content</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>content_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The SID associated with the domain of the content session. Salesforce returns a
                unique SID that the hybrid app directly sets in the domain’s session cookie.</p>
              <p style="margin-bottom:0;">You
                receive this value only if you assign the <code>content</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>lightning_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The domain of the Lightning session, which maps to the Lightning SID: <code><var>MyDomainName</var>.lightning.force.com →
                  lightning_sid</code>.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>lightning</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>lightning_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The SID associated with the domain of the Lightning session. Salesforce returns
                a unique SID that the hybrid app directly sets in the domain’s session cookie.</p>
              <p style="margin-bottom:0;">You
                receive this value only if you assign the <code>lightning</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>visualforce_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The domain of the Visualforce session, which maps to the Visualforce SID:
                <code><var>MyDomainName</var>.vf.force.com →
                  visualforce_sid</code>.
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>visualforce</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>visualforce_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The SID associated with the domain of the Visualforce session. Salesforce
                returns a unique SID that the hybrid app directly sets in the domain’s session
                cookie.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>visualforce</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>csrf_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The cross-site request forgery (CSRF) token to prevent attacks during child
                sessions.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>lightning</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>scope</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p>The scopes associated with the access token.</p>
              <p>Scopes further define the type
                of protected resources that the client can access. You assign scopes to an
                external client app when you build it, and they’re included with the OAuth tokens
                during the authorization flow. </p>
              <p style="margin-bottom:0;">For valid parameters, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&amp;type=5&amp;language=en_US" target="_blank">OAuth Scopes</a>.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>sidCookieName</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">The name of the session cookie that the hybrid app uses to directly bridge a
              web session. The default value is <code>sid</code>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>cookie-sid_Client</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">A session cookie that detects and prevents session tampering. This session
              cookie allows the hybrid app to directly bridge a web session.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>cookie-clientSrc</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">A session cookie that is used for security protections. This session cookie
              allows the hybrid app to directly bridge a web session.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e420 ">
              <code>parent_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d4743e423 ">
              <p style="margin-bottom:0;">A SID that's associated with the user's parent UI session. The <code>parent_sid</code> is included only if your app is enabled
                to issue JWT-based access tokens.</p>
            </td>

          </tr>
        </tbody>
      </table>

## App Sets Domain SIDs and Bridges a Web Session

The hybrid app sets the domains’ associated SIDs in the session cookies to directly bridge a web session. For examples of the cookies that are set for each domain, see [OAuth 2.0 Hybrid App Flow Cookie Management](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_flow_cookies.htm&release=264.0.0&type=5 "When you use the OAuth 2.0 hybrid app token flow, you use scopes to request session IDs (SID) and domain values. You then use these SIDs and domain values to set browser cookies and establish sessions in your hybrid app. When you refresh your access token, you receive new SIDs and domains to reset the browser cookies.").

For implementations that are resetting user division on objects for the Reset to Default Division on Login setting, the hybrid app must bridge a web session using frontdoor.jsp. For more information, see [Using Frontdoor.jsp to Bridge Sessions into Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_frontdoorjsp.htm&type=5&language=en_US). To learn more about user divisions, see [Organize Data with Divisions](https://help.salesforce.com/s/articleView?id=xcloud.admin_division.htm&type=5&language=en_US).

#### See Also

- [My Domain URL Formats](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_app_url_changes.htm&type=5&language=en_US)