---
schema_version: "1"
id: d803a938e6701ee8fd43523080cd6058b7686fc377d603b504c4894cc72ec75e
title: OAuth 2.0 Hybrid User-Agent Token Flow for Web Session Management
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_hybrid_app_token_flow_ca.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_token_flow_ca.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: bff3331e7d731f0601085eb8a448052e4d6363e999391946b1fb08a7644438a5
description: Use the OAuth 2.0 hybrid user-agent token flow to give hybrid apps direct management of web sessions. When the authorizing server grants an access token, it includes session IDs (SID) for the requested domains in its response. After authorization, the hybrid app can set Lightning, Visualforce, and content domain cookies and bridge an access token into a web session, providing uninterrupted service.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 Hybrid User-Agent Token Flow for Web Session Management

Use the OAuth 2.0 hybrid user-agent token flow to give hybrid apps direct management of web sessions. When the authorizing server grants an access token, it includes session IDs (SID) for the requested domains in its response. After authorization, the hybrid app can set Lightning, Visualforce, and content domain cookies and bridge an access token into a web session, providing uninterrupted service.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

The hybrid user-agent token flow follows the same authorization steps used in the [user-agent flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow_ca.htm&release=264.0.0&type=5 "With the OAuth 2.0 user-agent flow, users authorize a desktop or mobile app to access data by using an external or embedded browser. Client apps running in a browser using a scripting language such as JavaScript can also use this flow. This flow uses the OAuth 2.0 implicit grant type."), with the exception that the hybrid user-agent token flow uses `hybrid_token` as its grant type. For example, you build a hybrid app for your sales department to access information on the go, including a dashboard that tracks top sales prospects. This app implements the hybrid user-agent token flow, which follows these steps.

- To integrate the hybrid app with the Salesforce API, create a connected app. Enable OAuth settings and assign these OAuth scopes to the connected app:
- - `lightning`
    - `content`
    - `refresh_token`
    - `visualforce`
    - `web`
- The end user opens the app and is directed to Salesforce to authenticate and authorize the app.
- After the user approves access for this authorization flow, the connected app receives the callback from Salesforce to the redirect URL, which extracts the access and refresh tokens. The Visualforce, Lightning, and content SIDs for the respective domains are also included, along with session cookies that allow the app to directly bridge a web session.
- The app sets the Lightning, Visualforce, and content domains’ session cookies and bridges an access token into a web session.
- The user can access the top sales prospects dashboard without interrupted sessions.

Here’s the breakdown of each step of the OAuth 2.0 hybrid app flow.

- Create a connected app for the hybrid app.
- The app redirects uses to the authorization endpoint.
- The user authenticates and authorizes access.
- Salesforce grants the access token and requested scopes.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note The hybrid user-agent flow can issue only opaque access tokens. It doesn't support JWT-based access tokens.
- The app directly sets the SIDs in the domains’ session cookies and bridges a web session.

## Redirection to Authorization Endpoint

To get a user’s authorization to access Salesforce data, the app redirects the user to the authorization endpoint. Here’s an example HTTP redirection.

```
https://login.salesforce.com/services/oauth2/authorize?response_type=hybrid_token&
client_id=3MVG9lKcPoNINVBIPJjdw1J9LLJbP_pqwoJYyuisjQhr_LLurNDv7AgQvDTZwCoZuDZrXcPCmBv4o.8ds.5iE&
redirect_uri=https%3A%2F%2Flogin.salesforce.com%2Fservices%2Foauth2%2Fsuccess&scope=web%20visualforce%20refresh_token%20lightning%20content
```

Include these parameters in the URL.

 
| Parameter | Description |
| --- | --- |
| OAuth 2.0 authorization endpoint | The Salesforce instance’s OAuth 2.0 authorization endpoint. Connected apps send OAuth authorization requests to this endpoint. |
| `client_id` | The consumer key of the connected app. To access the consumer key, from the App Manager, find the connected app and select **View** from the dropdown. Then click **Manage Consumer Details**. You're sometimes prompted to verify your identity before you can view the consumer key. |
| `redirect_uri` | The URL where users are redirected after a successful authentication. The redirect URI must match one of the values in the connected app’s Callback URL field. Otherwise, the approval fails. You can find the redirect URI on the connected app’s Manage Connected Apps page or from the connected app’s definition. This value must be URL encoded. |
| `response_type` | Use the `hybrid_token` value. You can also use the `token id_token` value, with the `openid` scope and a `nonce` parameter. If you specify `token id_token`, Salesforce returns an ID token in the response. |

These parameters are optional.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d58794e283">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d58794e286">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e283 ">
              <code>scope</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e286 ">
              <p>Permissions that define the type of protected resources a connected app can
                access. You assign scopes to a connected app when you build it, and they’re included
                with the OAuth tokens during the authorization flow. </p>
              <p>If you don’t include this
                parameter, all scopes assigned to the connected app are requested. The scopes
                passed in this parameter must be a subset of the registered scopes. For valid
                parameters, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&amp;type=5&amp;language=en_US" target="_blank">OAuth Scopes</a>.</p>
              <p>For this flow, assign
                the <code>web</code> scope to the connected app so that it can access a web
                session. The <code>web</code> scope is a prerequisite for using the hybrid
                user-agent token flow. We also recommend configuring the connected app to access
                these scopes.</p>
              <ul>
                <li><code>content</code> (requests content SID and domain)</li>

                <li><code>lightning</code> (requests Lightning SID and domain)</li>

                <li><code>visualforce</code> (requests Visualforce SID and domain)</li>

                <li><code>refresh_token</code> (requests renewed sessions)</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e283 ">
              <code>state</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e286 ">Any state that the external web service requests to be sent to the callback
              URL. This value must be URL encoded.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e283 ">
              <code>display</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e286 ">
              <p>Changes the display type of the login and authorization pages. Salesforce
                supports these values.</p>
              <ul>
                <li><code>page</code>—Full-page authorization screen (default).</li>

                <li><code>popup</code>—Compact dialog optimized for modern web browser
                  popups.</li>

                <li><code>touch</code>—Mobile-optimized dialog designed for modern mobile
                  devices, such as Android and iPhone.</li>

                <li><code>mobile</code>—Mobile-optimized dialog designed for less capable
                  devices, such as BlackBerry operating system 5.</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e283 ">
              <code>login_hint</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e286 ">
              <p>Provides a valid username value to prepopulate the login page with the
                username, such as <code>login_hint=username@company.com</code>. If a user
                already has an active session in the browser, the <code>login_hint</code>
                parameter does nothing, and the active user session continues.</p>
              <p style="margin-bottom:0;">To pass the
                <code>login_hint</code> parameter for Experience Cloud sites, also pass the
                <code>prompt=login</code> parameter. Together, these parameters redirect the
                user to the login page with the correct login hint.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e283 ">
              <code>nonce</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e286 ">Use with the <code>openid</code> scope to request a user ID token. The user
              ID token is returned in the response. This parameter is optional, but it helps to
              detect replay attacks.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e283 ">
              <code>prompt</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e286 ">
              <p>Specifies how the authorization server prompts the user for reauthentication
                and reapproval. Salesforce supports these values.</p>
              <ul>
                <li><code>login</code>—The authorization server must prompt the user for
                  reauthentication, forcing the user to log in again.</li>

                <li><code>consent</code>—The authorization server must prompt the user for
                  reapproval before returning information to the client.</li>

                <li><code>select_account</code>—If presented, take one of these actions.<ul>
                    <li>If zero or one hint is available and the user is logged in, show the
                      approval page without prompting for login.</li>

                    <li>If zero or one hint is available and the user isn’t logged in, prompt for
                      login.</li>

                    <li>If more than one hint is available, show the account chooser.</li>

                  </ul>
                </li>

              </ul>
              <p style="margin-bottom:0;">You can pass <code>login</code> and <code>consent</code> values,
                separated by a space, to require the user to log in and reauthenticate. For
                example: <code>?prompt=login%20consent</code></p>
            </td>

          </tr>
        </tbody>
      </table>

## Users Authenticates and Authorizes Access

The user logs into Salesforce with their credentials. The user interacts with the authorization endpoint directly, so the app never sees the user’s credentials.

![Login page to Salesforce org](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/remoteaccess_authflow_login.png)

After a successful login, Salesforce redirects users to the approval page to grant access to the app.

## Salesforce Grants Access Token and Requested Scopes

After a user approves access to the app, Salesforce redirects the user to the callback URL. Included in the redirection is the granted access token, requested domain names, domain sessions, and associated scopes. The connected app extracts the token and parameters to access the scoped resources on the end user’s behalf.

Here’s an example of the callback from the server. The response is behind a hash tag (#), rather than as HTTP query parameters.

```
https://www.customercontactinfo.com/user_callback.jsp#
access_token=yourtokenhere&
refresh_token=yourtokenhere&
instance_url=https://yourInstance.salesforce.com/
id=https://user.internal.salesforce.com/7443%2Fid%2F00Dxx0000006HM7EAM%2F005xx000001X8ErAAK&
issued_at=1604004352722&
signature=DcQ84..
content_domain=MyDomainName.file.force.com&
content_sid=00Dxx0000006Gb…&
lightning_domain=MyDomainName.lightning.force.com&
lightning_sid=00Dxx000000...&
visualforce_domain=MyDomainName.file.force.com&
visualforce_sid=00Dxx000000...&
sidCookieName=sid&
cookie-sid_Client=0000000...&
cookie-clientSrc=10.xxx.xx.xx&
csrf_token=eyJub...&
scope=web+visualforce+refresh_token+lightning+content&
token_type=Bearer
```

The response in the example contains these parameters following the hash tag (#). The connected app’s callback URL precedes the hash tag (#).

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d58794e542">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d58794e545">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>access_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">OAuth token that a connected app uses to request access to a protected resource
              on behalf of the client application. Additional permissions in the form of scopes
              can accompany the access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>refresh_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>Token obtained from the web server, user-agent, or hybrid app token flow. This
                value is a secret. Take appropriate measures to protect it. </p>
              <p>The refresh token for
                the hybrid user-agent token flow is only issued if you requested
                <code>scope=refresh_token</code> and one of these scenarios is true.
              </p>
              <ul>
                <li>The redirect URL uses a custom protocol.</li>

                <li>The redirect URL host matches the request host and includes the servlet
                  <samp class="filepath">services/oauth2/success</samp>. For example:<ul>
                    <li><samp class="filepath">https://login.salesforce.com/services/oauth2/success</samp></li>

                    <li><samp class="filepath">https://test.salesforce.com/services/oauth2/success</samp></li>

                    <li><samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/oauth2/success</samp></li>

                    <li><samp class="filepath">https://<var>MyDomainName</var>.my.site.com/services/oauth2/success</samp></li>

                  </ul>
                </li>

                <li>The redirect URL is
                  <samp class="filepath">https://mobileauth.salesforce.com/oauth/done</samp>
                </li>

              </ul>
              <p style="margin-bottom:0;">The refresh token granted in this flow is fully compatible with the standard
                OAuth refresh token flow.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>instance_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">A URL indicating the instance of the user’s org. For example:
              <code>https://<var>yourInstance</var>.salesforce.com/</code>.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">An identity URL that can be used to identify the user and to query for more
              information about the user. See <a href="https://help.salesforce.com/articleView?id=remoteaccess_using_openid.htm&amp;language=en_US" target="_blank">Identity URLs</a>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>issued_at</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">Time stamp of when the signature was created in milliseconds.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>signature</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">Base64-encoded HMAC-SHA256 signature signed with the
              <code>client_secret</code>. The signature can include the concatenated ID and
              <code>issued_at value</code>, which you can use to verify that the identity
              URL hasn’t changed since the server sent it.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>scope</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>The scopes associated with the access token.</p>
              <p>Scopes further define the type
                of protected resources that the client can access. You assign scopes to a
                connected app when you build it, and they’re included with the OAuth tokens during
                the authorization flow. </p>
              <p style="margin-bottom:0;">For valid parameters, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&amp;type=5&amp;language=en_US" target="_blank">OAuth Scopes</a>.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>content_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>
                <span>The domain of the content session, which maps to the content SID:
                  <code><var>MyDomainName</var>.file.force.com →
                  content_sid</code>.</span>
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>content</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>content_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>
                <span>The SID associated with the domain of the content session. Salesforce returns a
                  unique SID that the hybrid app directly sets in the domain’s session cookie.</span>
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>content</code> scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>lightning_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>
                <span>The domain of the Lightning session, which maps to the Lightning SID:
                  <code><var>MyDomainName</var>.lightning.force.com →
                    lightning_sid</code>.</span>
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the <code>lightning</code>
                scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>lightning_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>The SID associated with the domain of the Lightning session. Salesforce returns
                a unique SID that the hybrid app directly sets in the domain’s session cookie.</p>
              <p style="margin-bottom:0;">You
                receive this value only if you assign the <code>lightning</code>
                scope.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>visualforce_domain</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>The domain of the Visualforce session, which maps to the Visualforce SID:
                <code><var>MyDomainName</var>.vf.force.com →
                  visualforce_sid</code>.
              </p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>visualforce</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>visualforce_sid</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>The SID associated with the domain of the Visualforce session. Salesforce
                returns a unique SID that the hybrid app directly sets in the domain’s session
                cookie.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>visualforce</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>token_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">A <code>Bearer</code> token type, which is used for all responses that
              include an access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>csrf_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">
              <p>The cross-site request forgery (CSRF) token to prevent attacks during child
                sessions.</p>
              <p style="margin-bottom:0;">You receive this value only if you assign the
                <code>lightning</code> scope.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>sidCookieName</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">The name of the session cookie that the hybrid app uses to directly bridge a
              web session. The default value is <code>sid</code>.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">&nbsp;</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">&nbsp;</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>cookie-sid_Client</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">A session cookie that detects and prevents session tampering. This session
              cookie allows the hybrid app to directly bridge a web session.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e542 ">
              <code>cookie-clientSrc</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e545 ">A session cookie that is used for security protections. This session cookie
              allows the hybrid app to directly bridge a web session.</td>

          </tr>
        </tbody>
      </table>

The response can also contain these parameters.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d58794e933">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d58794e936">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e933 ">
              <code>id_token</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e936 ">
              <p>A signed data structure that contains authenticated user attributes, including
                a unique identifier for the user and a timestamp indicating when the token was
                issued. It also identifies the requesting client app. See <a href="http://openid.net/specs/openid-connect-basic-1_0-28.html" target="_blank">OpenID Connect specifications</a>.</p>
              <p style="margin-bottom:0;">This parameter is returned if the
                <samp class="parmname">scope</samp> parameter includes
                <code>openid</code>.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e933 ">
              <code>sfdc_site_url</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e936 ">If the user is a member of an Experience Cloud site, the site URL is
              provided.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e933 ">
              <code>sfdc_site_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d58794e936 ">If the user is a member of an Experience Cloud site, the user’s site ID is
              provided.</td>

          </tr>
        </tbody>
      </table>

## App Sets Domain SIDs and Bridges a Web Session

The hybrid app sets the domains’ associated SIDs in the session cookies to directly bridge a web session.

For implementations that are resetting user division on objects for the Reset to Default Division on Login setting, the hybrid app must bridge a web session using frontdoor.jsp. For more information, see [Using Frontdoor.jsp to Bridge Sessions into Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_frontdoorjsp.htm&type=5&language=en_US). To learn more about user divisions, see [Organize Data with Divisions](https://help.salesforce.com/s/articleView?id=xcloud.admin_division.htm&type=5&language=en_US).