---
schema_version: "1"
id: 83e5e19bfdab31c9ba1de096a18e1f8a706c02173d0009fbb8cbc8085994eeb4
title: OAuth 2.0 Hybrid App Refresh Token Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_hybrid_app_refresh_token_flow_ca.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow_ca.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 494a8c04985322806c1b01130d980fa23e64fcfc2125ca41b843c4a277535029
description: Use the OAuth 2.0 hybrid app refresh token flow to give hybrid apps direct management of web sessions after an initial session expires. When the authorizing server grants a new access token using the hybrid_refresh grant type, it includes the session IDs (SID) of the requested domains in its response. The hybrid app can set Lightning, Visualforce, and content domain cookies and use frontdoor.jsp to bridge the access token into a web session, providing uninterrupted service. The hybrid app refresh token flow renews access tokens issued by the OAuth 2.0 web server, user-agent, and hybrid app token flow.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 Hybrid App Refresh Token Flow

Use the OAuth 2.0 hybrid app refresh token flow to give hybrid apps direct management of web sessions after an initial session expires. When the authorizing server grants a new access token using the hybrid\_refresh grant type, it includes the session IDs (SID) of the requested domains in its response. The hybrid app can set Lightning, Visualforce, and content domain cookies and use frontdoor.jsp to bridge the access token into a web session, providing uninterrupted service. The hybrid app refresh token flow renews access tokens issued by the OAuth 2.0 web server, user-agent, and hybrid app token flow.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (<a href="https://help.salesforce.com/s/articleView?id=xcloud.overview_edition_lex_only.htm&amp;type=5&amp;language=en_US" target="_blank">not available in all orgs</a>) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

After a hybrid app—via a connected app—receives an access token, it can use a refresh token to get a new session when its current session expires. The connected app’s session timeout value determines when an access token is no longer valid and when to apply for a new one using a refresh token.

For better security, enable refresh token rotation on your connected app or external client app when you configure its OAuth settings. With this setting enabled, the connected app issues a new refresh token along with the access token each time the flow is invoked. The previous refresh token is automatically invalidated. Refresh token rotation ensures that each refresh token is used only one time per user, so that refresh tokens can’t be used to get new access tokens. If someone tries to use a refresh token that’s been rotated out, Salesforce invalidates the current refresh token and any associated access tokens. To get a new refresh token, the client must complete a new flow.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note For the hybrid app refresh token flow, refresh token rotation is supported only if you issue opaque access tokens. If your connected app or external client app is configured to issue JWT-based access tokens, the hybrid app refresh token flow returns an `invalid_grant` error when you try to request a token.

The hybrid app refresh token flow involves these steps.

- [The app uses the existing refresh token to request a new access token.](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow_ca.htm&release=264.0.0&type=5)
- [After verifying the request, Salesforce grants a new access token to the app.](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow_ca.htm&release=264.0.0&type=5)
- [The app directly sets the SIDs in the domains’ session cookies and bridges a web session.](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_refresh_token_flow_ca.htm&release=264.0.0&type=5)

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_important.png)

Important When developing OAuth integrations, always pass sensitive information in the body of a POST request or in a request header. Don't use GET parameters in the URL query string to pass sensitive information. Sensitive information includes but isn't limited to usernames, passwords, OAuth tokens, client secrets, and any personally identifiable information. For more information on security best practices, see [Storing Sensitive Data](https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_storing_sensitive_data.htm) in the Secure Coding Guide.

## Request a New Access Token

The app can use the refresh token to get a new access token by sending a refresh token POST request to the Salesforce token endpoint.

The connected app can send the `client_id` and `client_secret` in the body of the refresh token POST request, as shown here.

```
POST /services/oauth2/token HTTP/1.1
Host: login.salesforce.com/ 
grant_type=hybrid_refresh&
client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&
client_secret=1955279925675241571&
refresh_token=your token here
```

Instead of sending client credentials as parameters in the body of the refresh token POST request, you can use the HTTP Basic authentication scheme. This scheme’s format requires the `client_id` and `client_secret` in the authorization header of the post: `Authorization: Basic64Encode(client_id:secret)`.

The `client_id` and `client_secret` are separated with a colon (:). For more information, see the [OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749).

This example shows a hybrid app refresh token POST request that uses the HTTP Basic authentication scheme rather than sending client credentials in the POST request’s body.

```
POST /services/oauth2/token HTTP/1.1
Host: login.salesforce.com
Authorization:  Basic 
client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&
client_secret=1955279925675241571
grant_type=hybrid_refresh&
refresh_token=your token here
```

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note If the `client_id` and `client_secret` are sent in the POST’s body, the authorization header is ignored.

With either refresh token POST request format, include these parameters.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d10962e199">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d10962e202">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e199 ">
              <code>client_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e202 ">The consumer key of the connected app. To access the consumer key, from the App
              Manager, find the connected app and select <strong class="uicontrol">View</strong> from the
              dropdown. Then click <strong class="uicontrol">Manage Consumer Details</strong>. You're
              sometimes prompted to verify your identity before you can view the consumer
              key.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e199 ">
              <code>client_secret</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e202 ">The consumer secret of the connected app. To access the consumer secret, from
              the App Manager, find the connected app and select <strong class="uicontrol">View</strong> from
              the dropdown. Then click <strong class="uicontrol">Manage Consumer Details</strong>. You're
              sometimes prompted to verify your identity before you can view the consumer
              secret.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e199 ">
              <code>grant_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e202 ">The OAuth 2.0 grant type that the connected app requests. The value must be
              <code>hybrid_refresh</code> for this flow.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e199 ">
              <code>refresh_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e202 ">Token obtained from the web server, user-agent, or hybrid app token flow. This
              value is a secret. Take appropriate measures to protect it. This parameter is
              returned only if your connected app is set up with a <code>refresh_token</code>
              scope.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e199 ">
              <code>client_assertion</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e202 ">Instead of passing a <code>client_secret</code>, you can provide a
              <code>client_assertion</code> and <code>client_assertion_type</code>. If a
              <code>client_secret</code> parameter isn’t provided, Salesforce checks for the
              <code>client_assertion</code> and <code>client_assertion_type</code>. See
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&amp;type=5&amp;language=en_US" target="_blank">Use <code>client_assertion</code> Instead of
                <code>client_secret</code></a>.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e199 ">
              <code>client_assertion_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e202 ">
              <p>Provide this value when using the <code>client_assertion</code>
                parameter.</p>
              <p style="margin-bottom:0;">The value of <code>client_assertion_type</code> must be
                <code>urn:ietf:params:oauth:client-assertion-type:jwt-bearer</code>.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e199 ">
              <code>format</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e202 ">
              <p>If not included in the request’s header, you can specify the expected return
                format. The <code>format</code> parameter takes precedence over the request’s
                header. These formats are supported.</p>
              <ul>
                <li><code>urlencoded</code></li>

                <li><code>json</code> (default)</li>

                <li><code>xml</code></li>

              </ul>
            </td>

          </tr>
        </tbody>
      </table>

## Salesforce Grants a New Access Token

After verifying the request, Salesforce sends a response with a new access token to the app. Here’s an example JSON response from Salesforce.

```
{ "id":"https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P",
"issued_at":"1278448384422",
"instance_url":"https://yourInstance.salesforce.com/",
"signature":"SSSbLO/gBhmmyNUvN18ODBDFYHzakxOMgqYtu+hDPsc=",
"access_token":"00Dx0000000BV7z!AR8AQP0jITN80ESEsj5EbaZTFG0RNBaT1cyWk7TrqoDjoNIWQ2ME_sTZzBjfmOE6zMHq6y8PIW4eWze9JksNEkWUl.Cju7m4",
"token_type":"Bearer",
"scope":"web visualforce refresh_token lightning content",
"cookie-clientSrc":"10.xxx.xx.xx",
"sidCookieName":"sid",
"cookie-sid_Client":"0000000...",
"content_domain":"MyDomainName.file.force.com",
"content_sid":"00Dxx0000006Gb…",
"lightning_domain":"MyDomainName.lightning.force.com",
"lightning_sid”:”00Dxx000000…",
"csrf_token":"ABCD…",
"visualforce_domain":"MyDomainName.vf.force.com",
"visualforce_sid":"00Dxx000000…"}
```

And here’s an example XML response.

```
<Oauth>
   <access_token>00Dx0000000BV7z!AR8AQP0jITN80ESEsj5EbaZTFG0RNB...</access_token>
   <token_type>Bearer</token_type>
   <scope>web visualforce refresh_token lightning content</scope>
   <cookie-clientSrc>10.xxx.xx.xx</cookie-clientSrc>
   <sidCookieName>sid</sidCookieName>
   <cookie-sid_Client>0000000...</cookie-sid_Client>
   <content_domain>MyDomainName.file.force.com</content_domain>
   <content_sid>00Dxx0000006Gb…</content_sid>
   <lightning_domain>MyDomainName.lightning.force.com</lightning_domain>
   <lightning_sid>00Dxx000000…</lighning_sid>
   <csrf_token>ABCD…</csrf_token>
   <visualforce_domain>MyDomainName.vf.force.com</visualforce_domain>
   <visualforce_sid>00Dxx000000…</visualforce_sid>
<instance_url>https://yourInstance.salesforce.com/</instance_url>
<id>https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P</id>
   <issued_at>1278448101416</issued_at>
   <signature>CMJ4l+CCaPQiKjoOEwEig9H4wqhpuLSk4J2urAe+fVg=</signature>
</Oauth>
```

This example shows a URL-encoded response.

```
access_token=00Dx0000000BV7z%21AR8AQP0jITN80ESEsj5E...&
token_type=Bearer&
instance_url=https%3A%2F%2FyourInstance.salesforce.com&
id=https://login.salesforce.com%2Fid%2F00Dx0000000BV7z%2F005x00000012Q9P&
issued_at=1278448101416&
signature=CMJ4l%2BCCaPQiKjoOEwEig9H4wqhpuLSk4J2...
cookie-clientSrc=10.xxx.xx.xx&
content_domain=MyDomainName.file.force.com&
content_sid=00Dxx0000006Gb...&
lightning_domain=MyDomainName.lightning.force.com&
lightning_sid=00Dxx000000...&
csrf_token=ABCD...&
visualforce_domain=MyDomainName.vf.force.com&
visualforce_sid=00Dxx000000...&
scope=web+visualforce+refresh_token+lightning+content&
sidCookieName=sid&
cookie-sid_Client=0000000...&
```

The following parameters can be included in the body of the response.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d10962e437">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d10962e440">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>access_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">OAuth token that a connected app uses to request access to a protected resource
              on behalf of the client application. Additional permissions in the form of scopes
              can accompany the access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>token_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">A <code>Bearer</code> token type, which is used for all responses that
              include an access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>instance_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">A URL indicating the instance of the user’s org. For example:
              <code>https://<var>yourInstance</var>.salesforce.com/</code>.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">An identity URL that can be used to identify the user and to query for more
              information about the user. See <a href="https://help.salesforce.com/articleView?id=remoteaccess_using_openid.htm&amp;language=en_US" target="_blank">Identity URLs</a>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>issued_at</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">Time stamp of when the signature was created in milliseconds.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>signature</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">Base64-encoded HMAC-SHA256 signature signed with the
              <code>client_secret</code>. The signature can include the concatenated ID and
              <code>issued_at value</code>, which you can use to verify that the identity
              URL hasn’t changed since the server sent it.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>sfdc_site_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">If the user is a member of an Experience Cloud site, the site URL is
              provided.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>sfdc_site_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">If the user is a member of an Experience Cloud site, the user’s site ID is
              provided.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>content_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The domain of the content session, which maps to the content SID:
                <code><var>MyDomainName</var>.file.force.com →
                  content_sid</code>.
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>content</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>content_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The SID associated with the domain of the content session. Salesforce returns a
                unique SID that the hybrid app directly sets in the domain’s session cookie.</p>
              <p style="margin-bottom:0;">You
                receive this value only if you assign the <code>content</code>
                scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>lightning_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The domain of the Lightning session, which maps to the Lightning SID:
                <code><var>MyDomainName</var>.lightning.force.com →
                  lightning_sid</code>.
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>lightning</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>lightning_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The SID associated with the domain of the Lightning session. Salesforce returns
                a unique SID that the hybrid app directly sets in the domain’s session cookie.</p>
              <p style="margin-bottom:0;">You
                receive this value only if you assign the <code>lightning</code>
                scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>visualforce_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The domain of the Visualforce session, which maps to the Visualforce SID:
                <code><var>MyDomainName</var>.vf.force.com →
                  visualforce_sid</code>.
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>visualforce</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>visualforce_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The SID associated with the domain of the Visualforce session. Salesforce
                returns a unique SID that the hybrid app directly sets in the domain’s session
                cookie.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>visualforce</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>csrf_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The cross-site request forgery (CSRF) token to prevent attacks during child
                sessions.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>lightning</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>scope</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p>The scopes associated with the access token.</p>
              <p>Scopes further define the type
                of protected resources that the client can access. You assign scopes to a
                connected app when you build it, and they’re included with the OAuth tokens during
                the authorization flow. </p>
              <p style="margin-bottom:0;">For valid parameters, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&amp;type=5&amp;language=en_US" target="_blank">OAuth Scopes</a>.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>sidCookieName</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">The name of the session cookie that the hybrid app uses to directly bridge a
              web session. The default value is <code>sid</code>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>cookie-sid_Client</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">A session cookie that detects and prevents session tampering. This session
              cookie allows the hybrid app to directly bridge a web session.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>cookie-clientSrc</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">A session cookie that is used for security protections. This session cookie
              allows the hybrid app to directly bridge a web session.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e437 ">
              <code>parent_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d10962e440 ">
              <p style="margin-bottom:0;">A SID that's associated with the user's parent UI session. The
                <code>parent_sid</code> is included only if your app is enabled to issue
                JWT-based access tokens.
              </p>
            </td>

          </tr>
        </tbody>
      </table>

## App Sets Domain SIDs and Bridges a Web Session

The hybrid app sets the domains’ associated SIDs in the session cookies to directly bridge a web session.

For implementations that are resetting user division on objects for the Reset to Default Division on Login setting, the hybrid app must bridge a web session using frontdoor.jsp. For more information, see [Using Frontdoor.jsp to Bridge Sessions into Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_frontdoorjsp.htm&type=5&language=en_US). To learn more about user divisions, see [Organize Data with Divisions](https://help.salesforce.com/s/articleView?id=xcloud.admin_division.htm&type=5&language=en_US).