---
schema_version: "1"
id: 532d4a1fcd6861d2f8f8f3744bd811fbdfe008540e1c2d88268f3ff74669a620
title: Authentication
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/platform/canvas-framework/guides/platform-connect/using/canvas-app-authentication.md
canonical_url: https://developer.salesforce.com/docs/platform/canvas-framework/guide/canvas-app-authentication.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 5aacf6522fc8eb74ff6a0e0ef354330834f1876040682d3edb09297411027e81
products:
  - Canvas Developer Guide
  - Platform Developer Content
---

# Authentication

When you create a Canvas app, you can use the signed request authentication method or the OAuth 2.0 authentication method.

**important:** If your Canvas app URL contains a URL fragment identifier (`#`), then the hash mark (`#`) and all characters that follow are stripped from the URL during the authentication flow. To prevent unexpected behavior, avoid using hash marks (`#`) in a Canvas app URL.

-   [Signed request](https://developer.salesforce.com/docs/platform/canvas-framework/guide/canvas-app-signed-req-authentication.md)—The default method of authentication for Canvas apps. The signed request containing the consumer key, access token, and other contextual information is provided to the Canvas app in one of these ways.

    -   The administrator allows access to the Canvas app for the user.
    -   The user approves the Canvas app in the OAuth flow.
-   [OAuth 2.0](https://developer.salesforce.com/docs/platform/canvas-framework/guide/canvas-app-oauth-authentication.md)—Canvas apps can use the OAuth 2.0 protocol to authorize and acquire access tokens. For more information about OAuth and the Lightning Platform, see [Authorize Apps with OAuth](https://help.salesforce.com/articleView?id=remoteaccess_authenticate.htm).

-   **[Signed Request Authentication](https://developer.salesforce.com/docs/platform/canvas-framework/guide/canvas-app-signed-req-authentication.md)**  


    Signed request is the default authorization method for Canvas apps. The signed request authorization flow varies depending on whether the administrator gives users access to the Canvas app or if users can self-authorize. You can verify signed request information with a client secret, then use signed requests to customize the app and make subsequent calls to Salesforce.

-   **[OAuth 2.0 Authorization](https://developer.salesforce.com/docs/platform/canvas-framework/guide/canvas-app-oauth-authentication.md)**  


    Canvas supports the OAuth 2.0 web server flow and the OAuth 2.0 user-agent flow.

-   **[SAML Single Sign-On for Canvas Apps](https://developer.salesforce.com/docs/platform/canvas-framework/guide/canvas-app-saml-sso-intro.md)**  


    Whether you use signed request or OAuth authorization, you can use SAML-based single sign-on (SSO) to provide your users with a seamless authentication flow. You can leverage Salesforce as an identity provider or as a service provider. SAML SSO enables you to give your users automatic authentication into your canvas app via SAML and authentication into Salesforce via the signed request.


**See Also**  


-   [Canvas SDK](https://developer.salesforce.com/docs/platform/canvas-framework/guide/canvas-framework-using-sdk.md)
-   [Understanding Authentication](https://salesforce.com/us/developer/docs/api_rest/index_Left.htm#StartTopic=Content/intro_understanding_authentication.htm)
-   [Canvas App User Flow—Signed Request](https://developer.salesforce.com/docs/platform/canvas-framework/guide/user-flow-signed-request.md)
-   [Canvas App User Flow—OAuth](https://developer.salesforce.com/docs/platform/canvas-framework/guide/user-flow-oauth.md)