Salesforce as an Identity Provider17% of the exam
Choosing OAuth 2.0 authorization flows and PKCE
How to pick the OAuth 2.0 flow from who is present and what the client can protect: web server flow with PKCE, the user-agent flow it replaces, the device flow for limited-input devices, and JWT bearer, client credentials and SAML bearer for unattended servers, plus why the username-password flow is blocked.
Given a scenario, identify the most appropriate OAuth flow (Web based, JWT, User agent, Device auth flow).
~8 min read · 14 practice questions ·
What the exam expects
- Identify the most appropriate OAuth flow from a scenario: web server (web based), JWT bearer, user-agent, device, client credentials or SAML bearer, from whether a person is present and whether the client can protect a secret or key.
- Explain how PKCE protects the authorization code and why Salesforce recommends the web server flow with PKCE in place of the user-agent flow.
- Replace the username-password flow in orgs where it is blocked.
- Key terms: authorization code (short-lived code exchanged for tokens in the web server flow); PKCE (code_challenge in the authorization request, matching code_verifier in the token request); public client (a mobile, desktop or browser app that can't keep a secret); prior approval (the user or admin authorized the app earlier); execution user (the Run As user that client credentials tokens act for).
Key facts
Authorization code lifetime
- Detail
- Expires after 15 minutes
code_challenge
- Detail
- Base64url SHA-256 hash of the code_verifier
Missing code_verifier
- Detail
- Login fails with invalid_grant
User-agent token delivery
- Detail
- In the # fragment of the callback URL; no client secret
Device and user codes
- Detail
- Both valid for 10 minutes
Device flow restriction
- Detail
- Local external client app, localhost callback, no other OAuth flows; blocked for all others on November 30, 2026
JWT bearer refresh token
- Detail
- Never issued
Client credentials host
- Detail
- My Domain URL; login and test hosts not supported
Username-password default
- Detail
- Blocked in orgs created Summer '23 or later
User-agent retirement
- Detail
- User-agent and hybrid user-agent flows retiring; enforced February 20, 2027
Username-password retirement
- Detail
- Summer '26+ orgs can't enable it; enforced for connected apps February 20, 2027
Sources for this section (10)
- Web Server Flowhelp.salesforce.com (opens in a new tab)
- PKCE Extensionhelp.salesforce.com (opens in a new tab)
- User-Agent Flowhelp.salesforce.com (opens in a new tab)
- Device Flowhelp.salesforce.com (opens in a new tab)
- Device Flow Release Updatehelp.salesforce.com (opens in a new tab)
- JWT Bearer Flowhelp.salesforce.com (opens in a new tab)
- Client Credentials Flowhelp.salesforce.com (opens in a new tab)
- Block Authorization Flowshelp.salesforce.com (opens in a new tab)
- User-Agent Flows Retirementhelp.salesforce.com (opens in a new tab)
- Username-Password Flow Retirementhelp.salesforce.com (opens in a new tab)
- Why does the web server flow with PKCE beat the user-agent flow for a public client?
- When does the device flow force a brand-new authorization request?
- When does the JWT bearer flow return a refresh token?
- Which flows does Salesforce recommend instead of the username-password flow?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (14 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams