---
schema_version: "1"
id: 04f5f72d1ec4e37af205082d2cdaf860349cce246951bcc647b9aaa61ef37a8a
title: OAuth 2.0 Hybrid User-Agent Token Flow for Web Session Management
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_hybrid_app_token_flow.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_token_flow.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 570af78f7903033c32dd4adc6d4b404b4198423e26e0d766f384f458bb8d0208
description: Use the OAuth 2.0 hybrid user-agent token flow to give hybrid apps direct management of web sessions. When the authorizing server grants an access token, it includes session IDs (SID) for the requested domains in its response. After authorization, the hybrid app can set Lightning, Visualforce, and content domain cookies and bridge an access token into a web session, providing uninterrupted service.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 Hybrid User-Agent Token Flow for Web Session Management

Use the OAuth 2.0 hybrid user-agent token flow to give hybrid apps direct management of web sessions. When the authorizing server grants an access token, it includes session IDs (SID) for the requested domains in its response. After authorization, the hybrid app can set Lightning, Visualforce, and content domain cookies and bridge an access token into a web session, providing uninterrupted service.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Mobile SDK 9.1 supports OAuth 2.0 hybrid app flows.

The hybrid user-agent token flow follows the same authorization steps used in the [user-agent flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&release=264.0.0&type=5 "With the OAuth 2.0 user-agent flow, users authorize a desktop or mobile app to access data by using an external or embedded browser. Client apps running in a browser using a scripting language such as JavaScript can also use this flow. This flow uses the OAuth 2.0 implicit grant type."), with the exception that the hybrid user-agent token flow uses `hybrid_token` as its grant type. For example, you build a hybrid app for your sales department to access information on the go, including a dashboard that tracks top sales prospects. This app implements the hybrid user-agent token flow, which follows these steps.

- To integrate the hybrid app with the Salesforce API, create an external client app. Enable OAuth settings and assign these OAuth scopes to the external client app:
- - `lightning`
    - `content`
    - `refresh_token`
    - `visualforce`
    - `web`
- The end user opens the app and is directed to Salesforce to authenticate and authorize the app.
- After the user approves access for this authorization flow, the external client app receives the callback from Salesforce to the redirect URL, which extracts the access and refresh tokens. The Visualforce, Lightning, and content SIDs for the respective domains are also included, along with session cookies that allow the app to directly bridge a web session.
- The app sets the Lightning, Visualforce, and content domains’ session cookies and bridges an access token into a web session.
- The user can access the top sales prospects dashboard without interrupted sessions.

Here’s the breakdown of each step of the OAuth 2.0 hybrid app flow.

- Create an external client app for the hybrid app.
- The app redirects uses to the authorization endpoint.
- The user authenticates and authorizes access.
- Salesforce grants the access token and requested scopes.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note The hybrid user-agent flow can issue only opaque access tokens. It doesn't support JWT-based access tokens.
- The app directly sets the SIDs in the domains’ session cookies and bridges a web session.

## Redirection to Authorization Endpoint

To get a user’s authorization to access Salesforce data, the app redirects the user to the authorization endpoint. Here’s an example HTTP redirection.

```
https://login.salesforce.com/services/oauth2/authorize?response_type=hybrid_token&
client_id=3MVG9lKcPoNINVBIPJjdw1J9LLJbP_pqwoJYyuisjQhr_LLurNDv7AgQvDTZwCoZuDZrXcPCmBv4o.8ds.5iE&
redirect_uri=https%3A%2F%2Flogin.salesforce.com%2Fservices%2Foauth2%2Fsuccess&scope=web%20visualforce%20refresh_token%20lightning%20content
```

Include these parameters in the URL.

 
| Parameter | Description |
| --- | --- |
| OAuth 2.0 authorization endpoint | The Salesforce instance’s OAuth 2.0 authorization endpoint. External client apps send OAuth authorization requests to this endpoint. |
| `client_id` | The consumer key of the external client app. To access the consumer key, from the External Client App Manager, find the external client app and select **Edit Settings** from the dropdown. Then expand the OAuth Settings section and click **Consumer Key and Secret**. You're sometimes prompted to verify your identity before you can view the consumer key. |
| `redirect_uri` | The URL where users are redirected after a successful authentication. The redirect URI must match one of the values in the external client app’s Callback URL field. Otherwise, the approval fails. You can find the redirect URI on the external client app’s OAuth Settings page. This value must be URL encoded. |
| `response_type` | Use the `hybrid_token` value. You can also use the `token id_token` value, with the `openid` scope and a `nonce` parameter. If you specify `token id_token`, Salesforce returns an ID token in the response. For more information, see [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&release=264.0.0&type=5 "OAuth tokens authorize access to protected resources. Connected apps receive tokens on behalf of a client after authorization. Scopes further define the type of protected resources that the connected app can access. You assign scopes to a connected app when you build it, and they’re included with the OAuth tokens during the authorization flow."). |

These parameters are optional.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d51829e278">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d51829e281">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e278 ">
              <code>scope</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e281 ">
              <p>Permissions that define the type of protected resources an external client app
                can access. You assign scopes to an external client app when you build it, and
                they’re included with the OAuth tokens during the authorization flow. </p>
              <p>If you
                don’t include this parameter, all scopes assigned to the external client app are
                requested. The scopes passed in this parameter must be a subset of the registered
                scopes. For valid parameters, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&amp;type=5&amp;language=en_US" target="_blank">OAuth Scopes</a>.</p>
              <p>For this flow, assign
                the <code>web</code> scope to the external client app so that it can access a
                web session. The <code>web</code> scope is a prerequisite for using the hybrid
                user-agent token flow. We also recommend configuring the external client app to
                access these scopes.</p>
              <ul>
                <li><code>content</code> (requests content SID and domain)</li>

                <li><code>lightning</code> (requests Lightning SID and domain)</li>

                <li><code>visualforce</code> (requests Visualforce SID and domain)</li>

                <li><code>refresh_token</code> (requests renewed sessions)</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e278 ">
              <code>state</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e281 ">Any state that the external web service requests to be sent to the callback
              URL. This value must be URL encoded.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e278 ">
              <code>display</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e281 ">
              <p>Changes the display type of the login and authorization pages. Salesforce
                supports these values.</p>
              <ul>
                <li><code>page</code>—Full-page authorization
                  screen (default).</li>
                <li><code>popup</code>—Compact dialog optimized for
                  modern web browser popups.</li>
                <li><code>touch</code>—Mobile-optimized dialog
                  designed for modern mobile devices, such as Android and iPhone.</li>
                <li><code>mobile</code>—Mobile-optimized dialog
                  designed for less capable devices, such as BlackBerry operating system 5.</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e278 ">
              <code>login_hint</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e281 ">
              <p>Provides a valid username value to prepopulate the login page with the
                username, such as <code>login_hint=username@company.com</code>. If a user already has an active session
                in the browser, the <code>login_hint</code> parameter does
                nothing, and the active user session continues.</p>
              <p style="margin-bottom:0;">To pass the <code>login_hint</code> parameter for Experience Cloud sites,
                also pass the <code>prompt=login</code> parameter.
                Together, these parameters redirect the user to the login page with the correct
                login hint.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e278 ">
              <code>nonce</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e281 ">Use with the <code>openid</code> scope to request a
              user ID token. The user ID token is returned in the response. This parameter is
              optional, but it helps to detect replay attacks.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e278 ">
              <code>prompt</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e281 ">
              <p>Specifies how the authorization server prompts the user for reauthentication
                and reapproval. Salesforce supports these values.</p>
              <ul>
                <li><code>login</code>—The authorization server
                  must prompt the user for reauthentication, forcing the user to log in
                  again.</li>
                <li><code>consent</code>—The authorization server
                  must prompt the user for reapproval before returning information to the
                  client.</li>
                <li><code>select_account</code>—If presented, take
                  one of these actions.<ul>
                    <li>If zero or one hint is available and the user is logged in, show the
                      approval page without prompting for login.</li>
                    <li>If zero or one hint is available and the user isn’t logged in, prompt for
                      login.</li>
                    <li>If more than one hint is available, show the account chooser.</li>
                  </ul>
                </li>
              </ul>
              <p style="margin-bottom:0;">You can pass <code>login</code> and <code>consent</code> values, separated by a space, to require
                the user to log in and reauthenticate. For example: <code>?prompt=login%20consent</code></p>
            </td>

          </tr>
        </tbody>
      </table>

## Users Authenticates and Authorizes Access

The user logs into Salesforce with their credentials. The user interacts with the authorization endpoint directly, so the app never sees the user’s credentials.

![Login page to Salesforce org](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/remoteaccess_authflow_login.png)

After a successful login, Salesforce redirects users to the approval page to grant access to the app.

## Salesforce Grants Access Token and Requested Scopes

After a user approves access to the app, Salesforce redirects the user to the callback URL. Included in the redirection is the granted access token, requested domain names, domain sessions, and associated scopes. The external client app extracts the token and parameters to access the scoped resources on the end user’s behalf.

Here’s an example of the callback from the server. The response is behind a hash tag (#), rather than as HTTP query parameters.

```
https://www.customercontactinfo.com/user_callback.jsp#
access_token=yourtokenhere&
refresh_token=yourtokenhere&
instance_url=https://yourInstance.salesforce.com/
id=https://user.internal.salesforce.com/7443%2Fid%2F00Dxx0000006HM7EAM%2F005xx000001X8ErAAK&
issued_at=1604004352722&
signature=DcQ84..
content_domain=MyDomainName.file.force.com&
content_sid=00Dxx0000006Gb…&
lightning_domain=MyDomainName.lightning.force.com&
lightning_sid=00Dxx000000...&
visualforce_domain=MyDomainName.file.force.com&
visualforce_sid=00Dxx000000...&
sidCookieName=sid&
cookie-sid_Client=0000000...&
cookie-clientSrc=10.xxx.xx.xx&
csrf_token=eyJub...&
scope=web+visualforce+refresh_token+lightning+content&
token_type=Bearer
```

The response in the example contains these parameters following the hash tag (#). The external client app’s callback URL precedes the hash tag (#).

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d51829e523">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d51829e526">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>access_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">OAuth token that an external client app uses to request access to a protected
              resource on behalf of the client application. Additional permissions in the form of
              scopes can accompany the access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>refresh_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>Token obtained from the web server, user-agent, or hybrid app token flow.
                This value is a secret. Take appropriate measures to protect it. </p>
              <p>The refresh
                token for the hybrid user-agent token flow is only issued if you requested <code>scope=refresh_token</code> and one of these scenarios is
                true.</p>
              <ul>
                <li>The redirect URL uses a custom protocol.</li>
                <li>The redirect URL host matches the request host and includes the servlet
                  <samp class="filepath">services/oauth2/success</samp>. For example:<ul>
                    <li><samp class="filepath">https://login.salesforce.com/services/oauth2/success</samp></li>
                    <li><samp class="filepath">https://test.salesforce.com/services/oauth2/success</samp></li>
                    <li><samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/oauth2/success</samp></li>
                    <li><samp class="filepath">https://<var>MyDomainName</var>.my.site.com/services/oauth2/success</samp></li>
                  </ul>
                </li>
                <li>The redirect URL is
                  <samp class="filepath">https://mobileauth.salesforce.com/oauth/done</samp>
                </li>
              </ul>
              <p style="margin-bottom:0;">The refresh token granted in this flow is fully compatible with the standard
                OAuth refresh token flow.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>instance_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">A URL indicating the instance of the user’s org. For example: <code>https://<var>yourInstance</var>.salesforce.com/</code>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">An identity URL that can be used to identify the user and to query for more
              information about the user. See <a href="https://help.salesforce.com/articleView?id=remoteaccess_using_openid.htm&amp;language=en_US" target="_blank">Identity
                URLs</a>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>issued_at</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">Time stamp of when the signature was created in milliseconds.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>signature</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">Base64-encoded HMAC-SHA256 signature signed with the <code>client_secret</code>. The signature can include the
              concatenated ID and <code>issued_at value</code>, which you
              can use to verify that the identity URL hasn’t changed since the server sent
              it.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>scope</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>The scopes associated with the access token.</p>
              <p>Scopes further define the type
                of protected resources that the client can access. You assign scopes to an
                external client app when you build it, and they’re included with the OAuth tokens
                during the authorization flow. </p>
              <p style="margin-bottom:0;">For valid parameters, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&amp;type=5&amp;language=en_US" target="_blank">OAuth Scopes</a>.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>content_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>
                <span>The domain of the content session, which maps to the content SID: <code><var>MyDomainName</var>.file.force.com →
                    content_sid</code>.</span>
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>content</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>content_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>
                <span>The SID associated with the domain of the content session. Salesforce
                  returns a unique SID that the hybrid app directly sets in the domain’s session
                  cookie.</span>
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>content</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>lightning_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>
                <span>The domain of the Lightning session, which maps to the Lightning SID:
                  <code><var>MyDomainName</var>.lightning.force.com
                    → lightning_sid</code>.</span>
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>lightning</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>lightning_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>The SID associated with the domain of the Lightning session. Salesforce
                returns a unique SID that the hybrid app directly sets in the domain’s session
                cookie.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>lightning</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>visualforce_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>The domain of the Visualforce session, which maps to the Visualforce SID:
                <code><var>MyDomainName</var>.vf.force.com →
                  visualforce_sid</code>.
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>visualforce</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>visualforce_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>The SID associated with the domain of the Visualforce session. Salesforce
                returns a unique SID that the hybrid app directly sets in the domain’s session
                cookie.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>visualforce</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>token_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">A <code>Bearer</code> token type, which is used for
              all responses that include an access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>csrf_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">
              <p>The cross-site request forgery (CSRF) token to prevent attacks during child
                sessions.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>lightning</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>sidCookieName</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">The name of the session cookie that the hybrid app uses to directly bridge a
              web session. The default value is <code>sid</code>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">&nbsp;</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">&nbsp;</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>cookie-sid_Client</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">A session cookie that detects and prevents session tampering. This session
              cookie allows the hybrid app to directly bridge a web session.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e523 ">
              <code>cookie-clientSrc</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e526 ">A session cookie that is used for security protections. This session cookie
              allows the hybrid app to directly bridge a web session.</td>

          </tr>
        </tbody>
      </table>

The response can also contain these parameters.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d51829e905">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d51829e908">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e905 ">
              <code>id_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e908 ">
              <p>A signed data structure that contains authenticated user attributes, including
                a unique identifier for the user and a timestamp indicating when the token was
                issued. It also identifies the requesting client app. See <a href="http://openid.net/specs/openid-connect-basic-1_0-28.html" target="_blank">OpenID Connect specifications</a>.</p>
              <p style="margin-bottom:0;">This parameter is
                returned if the <samp class="parmname">scope</samp> parameter includes <code>openid</code>.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e905 ">
              <code>sfdc_site_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e908 ">If the user is a member of an Experience Cloud site, the site URL is
              provided.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e905 ">
              <code>sfdc_site_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d51829e908 ">If the user is a member of an Experience Cloud site, the user’s site ID is
              provided.</td>

          </tr>
        </tbody>
      </table>

## App Sets Domain SIDs and Bridges a Web Session

The hybrid app sets the domains’ associated SIDs in the session cookies to directly bridge a web session. For examples of the cookies that are set for each domain, see [OAuth 2.0 Hybrid App Flow Cookie Management](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_flow_cookies.htm&release=264.0.0&type=5 "When you use the OAuth 2.0 hybrid app token flow, you use scopes to request session IDs (SID) and domain values. You then use these SIDs and domain values to set browser cookies and establish sessions in your hybrid app. When you refresh your access token, you receive new SIDs and domains to reset the browser cookies.").

For implementations that are resetting user division on objects for the Reset to Default Division on Login setting, the hybrid app must bridge a web session using frontdoor.jsp. For more information, see [Using Frontdoor.jsp to Bridge Sessions into Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_frontdoorjsp.htm&type=5&language=en_US). To learn more about user divisions, see [Organize Data with Divisions](https://help.salesforce.com/s/articleView?id=xcloud.admin_division.htm&type=5&language=en_US).

#### See Also

- [My Domain URL Formats](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_app_url_changes.htm&type=5&language=en_US)