KysoqlAPI reference
Auth API reference
Generated API reference for Salesforce authentication, OAuth flows, token storage, and refresh management in @kysoql/auth.
Functions
| Function | Description |
|---|---|
| createCodeCredentialsAuthorizationRequest | Builds the POST used by Salesforce Headless Identity's Authorization Code and Credentials flow. The returned request uses redirect: "manual" so credentials aren't automatically forwarded through a redirect by fetch. |
| createHeadlessGuestAuthorizationRequest | Builds the authorization request for Salesforce Headless Identity's guest variation of Authorization Code and Credentials. Salesforce requires the UVID/JWT prefix during authorization; the later token exchange uses the raw value through exchangeAuthorizationCode({ authRequestType: "guest", ... }). |
| requestFirstPartyAuthorizationChallenge | Calls the OAuth 2.0 for First-Party Applications authorization-challenge endpoint. The generic parameter bag intentionally follows Salesforce because login, passwordless, registration, reCAPTCHA, and continuation steps require different documented fields. |
| createJwtBearerAssertion | Creates an RS256 JWT bearer assertion for Salesforce server-to-server authentication. |
| createOAuthClientAssertion | Creates the private_key_jwt client assertion accepted by Salesforce token endpoints. |
| createStoredRefreshTokenAuth | Creates a refresh-token-backed access-token manager with single-flight refreshes. |
| authenticateClientCredentials | OAuth 2.0 client-credentials grant. Use a configured Salesforce My Domain. |
| authenticateJwtBearer | OAuth 2.0 JWT bearer token exchange. The assertion can be created with createJwtBearerAssertion. |
| authenticateSamlAssertion | Salesforce SAML assertion flow for API access. |
| authenticateSamlBearer | OAuth 2.0 SAML bearer assertion exchange. |
| createAuthorizationUrl | Builds a validated Salesforce OAuth authorization URL without making a network request. |
| exchangeAuthorizationCode | OAuth 2.0 web-server authorization-code exchange, including PKCE and headless code exchanges. |
| exchangeHybridAuthorizationCode | OAuth 2.0 hybrid web-server authorization-code exchange. |
| exchangeToken | OAuth 2.0 token exchange using one of Salesforce's supported subject-token types. |
| pollDeviceAuthorization | Performs one device-flow polling exchange. Handle authorization_pending or slow_down and poll again. |
| refreshAccessToken | OAuth 2.0 refresh-token exchange. Rotated refresh tokens are persisted when a store is supplied. |
| refreshHybridAccessToken | Hybrid-app refresh exchange for a refresh token obtained by a supported hybrid/web-server flow. |
| requestDeviceAuthorization | Starts Salesforce's OAuth 2.0 device flow. |
| createPkceChallenge | Derives an S256 PKCE code challenge from a verifier. |
| generatePkcePair | Generates a cryptographically random PKCE verifier and its S256 challenge. |
| createLocalStorageRefreshTokenStore | Creates a refresh-token store backed by a provided Web Storage implementation. |
| createMemoryRefreshTokenStore | Creates an in-memory refresh-token store for short-lived processes and tests. |
| createRedisRefreshTokenStore | Creates a refresh-token store backed by a Redis-compatible client. |
Classes
| Class | Description |
|---|---|
| SalesforceOAuthError | OAuth endpoint rejection without credential-bearing server descriptions in the message. |
| SalesforceOAuthResponseError | Salesforce returned a successful response that does not match the documented contract. |
| SalesforceAuth | Bound Salesforce OAuth client. |
Interfaces
| Interface | Description |
|---|---|
| CodeCredentialsNamedUserOptions | Options for headless authorization with an explicit Salesforce username and password. |
| CodeCredentialsUserDiscoveryOptions | Options for headless authorization that discovers the Salesforce user from a login hint. |
| FirstPartyAuthorizationChallengeOptions | Options for requesting a first-party Salesforce authorization challenge. |
| HeadlessAuthorizationRequest | Fetch-compatible request data for a Salesforce Headless Identity authorization call. |
| OAuthRequestOptions | Shared transport options for Salesforce OAuth requests. |
| JwtBearerAssertionOptions | Options for creating a Salesforce JWT bearer assertion. |
| OAuthClientAssertionOptions | Options for creating a private_key_jwt client assertion for Salesforce OAuth. |
| AccessTokenRequest | Describes whether an access-token provider should force a token refresh. |
| StoredRefreshTokenAuth | Access-token manager that refreshes and persists rotated Salesforce refresh tokens. |
| StoredRefreshTokenAuthOptions | Options for access-token management backed by a persistent refresh-token store. |
| AuthorizationCodeOptions | Options for exchanging a Salesforce authorization code for tokens. |
| AuthorizationUrlOptions | Options for building a Salesforce OAuth authorization URL. |
| ClientCredentialsOptions | Options for the Salesforce OAuth client-credentials grant. |
| DeviceAuthorization | Device-code response returned when starting Salesforce device authorization. |
| DeviceAuthorizationOptions | Options for starting the Salesforce device authorization flow. |
| DeviceTokenOptions | Options for polling Salesforce for completion of device authorization. |
| JwtBearerOptions | Options for the Salesforce JWT bearer token grant. |
| RefreshTokenOptions | Options for exchanging a Salesforce refresh token for a new session. |
| SalesforceOAuthSession | Tokens and instance metadata returned by a Salesforce OAuth exchange. |
| SamlAssertionOptions | Options for the Salesforce SAML assertion token grant. |
| SamlBearerOptions | Options for the Salesforce SAML bearer token grant. |
| TokenExchangeOptions | Options for Salesforce OAuth 2.0 token exchange. |
| PkcePair | PKCE verifier and matching S256 challenge. |
| SalesforceAuthOptions | Options for the high-level Salesforce authentication helper. |
| SalesforceJwtBearerOptions | JWT bearer credentials accepted by SalesforceAuth. |
| LocalStorageRefreshTokenStoreOptions | Options for a refresh-token store backed by Web Storage. |
| RedisLike | Minimal Redis interface required by the Redis refresh-token store. |
| RedisRefreshTokenStoreOptions | Options for a refresh-token store backed by Redis. |
| RefreshTokenStore | Minimal async store used to load and persist Salesforce refresh tokens. |
| StorageLike | Subset of the Web Storage API required by the local-storage token store. |
Type Aliases
| Type Alias | Description |
|---|---|
| CodeCredentialsAuthorizationOptions | Options accepted by the Headless Identity authorization-code-and-credentials flow. |
| FirstPartyAuthorizationChallenge | Result of a first-party Salesforce authorization challenge request. |
| FirstPartyAuthorizationValue | Serializable value accepted in first-party authorization challenge parameters. |
| HeadlessGuestAuthorizationOptions | Options for the guest variant of Salesforce Headless Identity authorization. |
| PrivateKeyInput | Supported sources for the RSA private key used to sign Salesforce JWT assertions. |
| AccessTokenProvider | Provides an access token, optionally forcing refresh for an authentication retry. |
| ClientAssertionProvider | Creates a client assertion, typically regenerated for each token refresh. |
| TokenExchangeSubjectTokenType | Subject-token types supported by Salesforce OAuth token exchange. |
| SalesforceClientAssertionOptions | Client-assertion credentials accepted by SalesforceAuth. |