Authentication: OAuth 2.0, Connected Apps and External Client Apps

Headless Salesforce & APIsAuthentication: OAuth 2.0, Connected Apps and External Client AppsHow clients obtain and manage Salesforce tokens: OAuth 2.0 and OpenID Connect fundamentals, External Client Apps versus Connected Apps, every supported flow with real requests, scopes, policies, token lifecycle and secret management.Intermediate · about 90 minutesWhat you will learn

Explain the OAuth 2.0 roles, endpoints and token types as implemented by Salesforce

Compare External Client Apps with Connected Apps and create an External Client App with the right settings and policies

Choose the correct flow (Web Server + PKCE, JWT Bearer, Client Credentials, Device, Refresh Token, Token Exchange) for a scenario and implement it with curl, Node.js or Python

Request the minimum set of OAuth scopes, including scopes for Data 360 and AI APIs

Validate OpenID Connect ID tokens and use introspection and revocation endpoints

Apply security best practices for secrets, certificates, IP policies and integration users

Contents

OAuth 2.0 in Salesforce terms

External Client Apps versus Connected Apps

Choosing a flow

Authorization Code (Web Server) flow with PKCE

User-Agent flow (discouraged)

JWT Bearer flow

Client Credentials flow

Refresh tokens and rotation

Device flow

Username-Password flow (do not use)

Token Exchange flow

SAML Bearer assertion flow (brief)

OpenID Connect

Scopes

Token introspection and revocation

App policies: who, where and how long

Outbound authentication: Named Credentials

Worked example: three apps for one headless product

Secrets management and security best practices

Common pitfalls

Hands-on exercises

Key takeaways