# Choosing OAuth 2.0 authorization flows and PKCE

*Platform Identity and Access Management Architect Study Guide · Salesforce as an Identity Provider · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/salesforce-as-an-identity-provider/choosing-oauth-2-0-authorization-flows-and-pkce*

How to pick the OAuth 2.0 flow from who is present and what the client can protect: web server flow with PKCE, the user-agent flow it replaces, the device flow for limited-input devices, and JWT bearer, client credentials and SAML bearer for unattended servers, plus why the username-password flow is blocked.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Salesforce as an Identity Provider
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, identify the most appropriate OAuth flow (Web based, JWT, User agent, Device auth flow).

## What the exam expects

- Identify the most appropriate OAuth flow from a scenario: web server (web based), JWT bearer, user-agent, device, client credentials or SAML bearer, from whether a person is present and whether the client can protect a secret or key.
- Explain how PKCE protects the authorization code and why Salesforce recommends the web server flow with PKCE in place of the user-agent flow.
- Replace the username-password flow in orgs where it is blocked.
- Key terms: **authorization code** (short-lived code exchanged for tokens in the web server flow); **PKCE** (code_challenge in the authorization request, matching code_verifier in the token request); **public client** (a mobile, desktop or browser app that can't keep a secret); **prior approval** (the user or admin authorized the app earlier); **execution user** (the Run As user that client credentials tokens act for).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Authorization code lifetime | Expires after 15 minutes | [Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5) |
| code_challenge | Base64url SHA-256 hash of the code_verifier | [PKCE Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&language=en_US&type=5) |
| Missing code_verifier | Login fails with invalid_grant | [Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5) |
| User-agent token delivery | In the # fragment of the callback URL; no client secret | [User-Agent Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&language=en_US&type=5) |
| Device and user codes | Both valid for 10 minutes | [Device Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_device_flow.htm&language=en_US&type=5) |
| Device flow restriction | Local external client app, localhost callback, no other OAuth flows; blocked for all others on November 30, 2026 | [Device Flow Release Update](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_device_flow_restrictions.htm&language=en_US&release=262&type=5) |
| JWT bearer refresh token | Never issued | [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&language=en_US&type=5) |
| Client credentials host | My Domain URL; login and test hosts not supported | [Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US&type=5) |
| Username-password default | Blocked in orgs created Summer '23 or later | [Block Authorization Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US&type=5) |
| User-agent retirement | User-agent and hybrid user-agent flows retiring; enforced February 20, 2027 | [User-Agent Flows Retirement](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_user_agent_retirement.htm&language=en_US&release=262&type=5) |
| Username-password retirement | Summer '26+ orgs can't enable it; enforced for connected apps February 20, 2027 | [Username-Password Flow Retirement](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5) |

## Check yourself

- Why does the web server flow with PKCE beat the user-agent flow for a public client?
- When does the device flow force a brand-new authorization request?
- When does the JWT bearer flow return a refresh token?
- Which flows does Salesforce recommend instead of the username-password flow?

## Sources

- [OAuth Authorization Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flows_ca.htm&language=en_US&type=5)
- [OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5)
- [Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&language=en_US&type=5)
- [OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Device Flow for IoT Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_device_flow.htm&language=en_US&type=5)
- [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US&type=5)
- [OAuth 2.0 SAML Bearer Assertion Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_SAML_bearer_flow.htm&language=en_US&type=5)
- [Block Authorization Flows to Improve Security](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&language=en_US&type=5)
- [Prepare for Salesforce Connected App Usage Restrictions Change](https://help.salesforce.com/s/articleView?id=005132365&language=en_US&type=1)
- [Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_device_flow_restrictions.htm&language=en_US&release=262&type=5)
- [Embedded Login](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_embedded_login_use_cases.htm&language=en_US&type=5)
- [OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_user_agent_retirement.htm&language=en_US&release=262&type=5)
- [Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 14 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams