Salesforce as an Identity Provider17% of the exam
Connected app OAuth settings, scopes and permitted users
Which OAuth settings a connected app or external client app needs for each flow (callback URL, device flow, client credentials with a Run As user, PKCE and the web server secret), how to pick least-privilege scopes, and how Permitted Users and the Use Any API Client permission decide who can authorize.
Given a scenario, recommend appropriate scope and configuration of the connected app for authorization.
~8 min read · 11 practice questions ·
What the exam expects
- Configure a connected app's OAuth settings for the chosen flow: callback URL, device flow, client credentials with an execution user, PKCE and the web server secret.
- Recommend the least-privilege set of OAuth scopes for a described app, and predict which scopes a token actually receives.
- Choose a Permitted Users policy and grant access through profiles or permission sets, and explain how the Use Any API Client permission bypasses it.
- Key terms: callback URL (the registered redirect URIs an authorization request must match); scope (a permission granted with the token, such as api or openid); Permitted Users (the policy deciding whether users self-authorize or must be pre-authorized); execution user (the Run As user client credentials tokens act for).
Key facts
Callback URL limit
- Detail
- 2000 characters in total; separate URLs with line breaks
redirect_uri_mismatch
- Detail
- Redirect URI doesn't match the app definition
JWT certificate
- Detail
- Use Digital Signatures; 4,000 characters, under 4 KB
Client credentials execution user
- Detail
- Required; Permitted Users policies don't apply to it
Omitted scope parameter
- Detail
- All scopes assigned to the app are requested
full scope
- Detail
- Doesn't return a refresh token
id scope
- Detail
- Included in all scope values
Permitted Users default
- Detail
- All users may self-authorize
Use Any API Client
- Detail
- Access to any connected app, even admin-approved ones
Sources for this section (6)
- Enable OAuth Settingshelp.salesforce.com (opens in a new tab)
- Authorization Errorshelp.salesforce.com (opens in a new tab)
- Client Credentials Setuphelp.salesforce.com (opens in a new tab)
- Web Server Flowhelp.salesforce.com (opens in a new tab)
- OAuth Tokens and Scopeshelp.salesforce.com (opens in a new tab)
- Manage OAuth Access Policieshelp.salesforce.com (opens in a new tab)
- Why does a redirect_uri_mismatch error follow a portal's move to a new host name?
- When does an app need to request the id scope separately?
- Which scope lets an external app check whether the signed-in user has a custom permission?
- When do current users lose access to an app after a policy change?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams