# Auth API reference (/docs/auth/api) ## Functions [#functions] | Function | Description | | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [createCodeCredentialsAuthorizationRequest](/docs/auth/api/functions/createCodeCredentialsAuthorizationRequest) | Builds the POST used by Salesforce Headless Identity's Authorization Code and Credentials flow. The returned request uses redirect: "manual" so credentials aren't automatically forwarded through a redirect by fetch. | | [createHeadlessGuestAuthorizationRequest](/docs/auth/api/functions/createHeadlessGuestAuthorizationRequest) | Builds the authorization request for Salesforce Headless Identity's guest variation of Authorization Code and Credentials. Salesforce requires the UVID/JWT prefix during authorization; the later token exchange uses the raw value through `exchangeAuthorizationCode({ authRequestType: "guest", ... })`. | | [requestFirstPartyAuthorizationChallenge](/docs/auth/api/functions/requestFirstPartyAuthorizationChallenge) | Calls the OAuth 2.0 for First-Party Applications authorization-challenge endpoint. The generic parameter bag intentionally follows Salesforce because login, passwordless, registration, reCAPTCHA, and continuation steps require different documented fields. | | [createJwtBearerAssertion](/docs/auth/api/functions/createJwtBearerAssertion) | Creates an RS256 JWT bearer assertion for Salesforce server-to-server authentication. | | [createOAuthClientAssertion](/docs/auth/api/functions/createOAuthClientAssertion) | Creates the private\_key\_jwt client assertion accepted by Salesforce token endpoints. | | [createStoredRefreshTokenAuth](/docs/auth/api/functions/createStoredRefreshTokenAuth) | Creates a refresh-token-backed access-token manager with single-flight refreshes. | | [authenticateClientCredentials](/docs/auth/api/functions/authenticateClientCredentials) | OAuth 2.0 client-credentials grant. Use a configured Salesforce My Domain. | | [authenticateJwtBearer](/docs/auth/api/functions/authenticateJwtBearer) | OAuth 2.0 JWT bearer token exchange. The assertion can be created with createJwtBearerAssertion. | | [authenticateSamlAssertion](/docs/auth/api/functions/authenticateSamlAssertion) | Salesforce SAML assertion flow for API access. | | [authenticateSamlBearer](/docs/auth/api/functions/authenticateSamlBearer) | OAuth 2.0 SAML bearer assertion exchange. | | [createAuthorizationUrl](/docs/auth/api/functions/createAuthorizationUrl) | Builds a validated Salesforce OAuth authorization URL without making a network request. | | [exchangeAuthorizationCode](/docs/auth/api/functions/exchangeAuthorizationCode) | OAuth 2.0 web-server authorization-code exchange, including PKCE and headless code exchanges. | | [exchangeHybridAuthorizationCode](/docs/auth/api/functions/exchangeHybridAuthorizationCode) | OAuth 2.0 hybrid web-server authorization-code exchange. | | [exchangeToken](/docs/auth/api/functions/exchangeToken) | OAuth 2.0 token exchange using one of Salesforce's supported subject-token types. | | [pollDeviceAuthorization](/docs/auth/api/functions/pollDeviceAuthorization) | Performs one device-flow polling exchange. Handle authorization\_pending or slow\_down and poll again. | | [refreshAccessToken](/docs/auth/api/functions/refreshAccessToken) | OAuth 2.0 refresh-token exchange. Rotated refresh tokens are persisted when a store is supplied. | | [refreshHybridAccessToken](/docs/auth/api/functions/refreshHybridAccessToken) | Hybrid-app refresh exchange for a refresh token obtained by a supported hybrid/web-server flow. | | [requestDeviceAuthorization](/docs/auth/api/functions/requestDeviceAuthorization) | Starts Salesforce's OAuth 2.0 device flow. | | [createPkceChallenge](/docs/auth/api/functions/createPkceChallenge) | Derives an S256 PKCE code challenge from a verifier. | | [generatePkcePair](/docs/auth/api/functions/generatePkcePair) | Generates a cryptographically random PKCE verifier and its S256 challenge. | | [createLocalStorageRefreshTokenStore](/docs/auth/api/functions/createLocalStorageRefreshTokenStore) | Creates a refresh-token store backed by a provided Web Storage implementation. | | [createMemoryRefreshTokenStore](/docs/auth/api/functions/createMemoryRefreshTokenStore) | Creates an in-memory refresh-token store for short-lived processes and tests. | | [createRedisRefreshTokenStore](/docs/auth/api/functions/createRedisRefreshTokenStore) | Creates a refresh-token store backed by a Redis-compatible client. | ## Classes [#classes] | Class | Description | | ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | [SalesforceOAuthError](/docs/auth/api/classes/SalesforceOAuthError) | OAuth endpoint rejection without credential-bearing server descriptions in the message. | | [SalesforceOAuthResponseError](/docs/auth/api/classes/SalesforceOAuthResponseError) | Salesforce returned a successful response that does not match the documented contract. | | [SalesforceAuth](/docs/auth/api/classes/SalesforceAuth) | Bound Salesforce OAuth client. | ## Interfaces [#interfaces] | Interface | Description | | ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | | [CodeCredentialsNamedUserOptions](/docs/auth/api/interfaces/CodeCredentialsNamedUserOptions) | Options for headless authorization with an explicit Salesforce username and password. | | [CodeCredentialsUserDiscoveryOptions](/docs/auth/api/interfaces/CodeCredentialsUserDiscoveryOptions) | Options for headless authorization that discovers the Salesforce user from a login hint. | | [FirstPartyAuthorizationChallengeOptions](/docs/auth/api/interfaces/FirstPartyAuthorizationChallengeOptions) | Options for requesting a first-party Salesforce authorization challenge. | | [HeadlessAuthorizationRequest](/docs/auth/api/interfaces/HeadlessAuthorizationRequest) | Fetch-compatible request data for a Salesforce Headless Identity authorization call. | | [OAuthRequestOptions](/docs/auth/api/interfaces/OAuthRequestOptions) | Shared transport options for Salesforce OAuth requests. | | [JwtBearerAssertionOptions](/docs/auth/api/interfaces/JwtBearerAssertionOptions) | Options for creating a Salesforce JWT bearer assertion. | | [OAuthClientAssertionOptions](/docs/auth/api/interfaces/OAuthClientAssertionOptions) | Options for creating a private\_key\_jwt client assertion for Salesforce OAuth. | | [AccessTokenRequest](/docs/auth/api/interfaces/AccessTokenRequest) | Describes whether an access-token provider should force a token refresh. | | [StoredRefreshTokenAuth](/docs/auth/api/interfaces/StoredRefreshTokenAuth) | Access-token manager that refreshes and persists rotated Salesforce refresh tokens. | | [StoredRefreshTokenAuthOptions](/docs/auth/api/interfaces/StoredRefreshTokenAuthOptions) | Options for access-token management backed by a persistent refresh-token store. | | [AuthorizationCodeOptions](/docs/auth/api/interfaces/AuthorizationCodeOptions) | Options for exchanging a Salesforce authorization code for tokens. | | [AuthorizationUrlOptions](/docs/auth/api/interfaces/AuthorizationUrlOptions) | Options for building a Salesforce OAuth authorization URL. | | [ClientCredentialsOptions](/docs/auth/api/interfaces/ClientCredentialsOptions) | Options for the Salesforce OAuth client-credentials grant. | | [DeviceAuthorization](/docs/auth/api/interfaces/DeviceAuthorization) | Device-code response returned when starting Salesforce device authorization. | | [DeviceAuthorizationOptions](/docs/auth/api/interfaces/DeviceAuthorizationOptions) | Options for starting the Salesforce device authorization flow. | | [DeviceTokenOptions](/docs/auth/api/interfaces/DeviceTokenOptions) | Options for polling Salesforce for completion of device authorization. | | [JwtBearerOptions](/docs/auth/api/interfaces/JwtBearerOptions) | Options for the Salesforce JWT bearer token grant. | | [RefreshTokenOptions](/docs/auth/api/interfaces/RefreshTokenOptions) | Options for exchanging a Salesforce refresh token for a new session. | | [SalesforceOAuthSession](/docs/auth/api/interfaces/SalesforceOAuthSession) | Tokens and instance metadata returned by a Salesforce OAuth exchange. | | [SamlAssertionOptions](/docs/auth/api/interfaces/SamlAssertionOptions) | Options for the Salesforce SAML assertion token grant. | | [SamlBearerOptions](/docs/auth/api/interfaces/SamlBearerOptions) | Options for the Salesforce SAML bearer token grant. | | [TokenExchangeOptions](/docs/auth/api/interfaces/TokenExchangeOptions) | Options for Salesforce OAuth 2.0 token exchange. | | [PkcePair](/docs/auth/api/interfaces/PkcePair) | PKCE verifier and matching S256 challenge. | | [SalesforceAuthOptions](/docs/auth/api/interfaces/SalesforceAuthOptions) | Options for the high-level Salesforce authentication helper. | | [SalesforceJwtBearerOptions](/docs/auth/api/interfaces/SalesforceJwtBearerOptions) | JWT bearer credentials accepted by SalesforceAuth. | | [LocalStorageRefreshTokenStoreOptions](/docs/auth/api/interfaces/LocalStorageRefreshTokenStoreOptions) | Options for a refresh-token store backed by Web Storage. | | [RedisLike](/docs/auth/api/interfaces/RedisLike) | Minimal Redis interface required by the Redis refresh-token store. | | [RedisRefreshTokenStoreOptions](/docs/auth/api/interfaces/RedisRefreshTokenStoreOptions) | Options for a refresh-token store backed by Redis. | | [RefreshTokenStore](/docs/auth/api/interfaces/RefreshTokenStore) | Minimal async store used to load and persist Salesforce refresh tokens. | | [StorageLike](/docs/auth/api/interfaces/StorageLike) | Subset of the Web Storage API required by the local-storage token store. | ## Type Aliases [#type-aliases] | Type Alias | Description | | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------- | | [CodeCredentialsAuthorizationOptions](/docs/auth/api/type-aliases/CodeCredentialsAuthorizationOptions) | Options accepted by the Headless Identity authorization-code-and-credentials flow. | | [FirstPartyAuthorizationChallenge](/docs/auth/api/type-aliases/FirstPartyAuthorizationChallenge) | Result of a first-party Salesforce authorization challenge request. | | [FirstPartyAuthorizationValue](/docs/auth/api/type-aliases/FirstPartyAuthorizationValue) | Serializable value accepted in first-party authorization challenge parameters. | | [HeadlessGuestAuthorizationOptions](/docs/auth/api/type-aliases/HeadlessGuestAuthorizationOptions) | Options for the guest variant of Salesforce Headless Identity authorization. | | [PrivateKeyInput](/docs/auth/api/type-aliases/PrivateKeyInput) | Supported sources for the RSA private key used to sign Salesforce JWT assertions. | | [AccessTokenProvider](/docs/auth/api/type-aliases/AccessTokenProvider) | Provides an access token, optionally forcing refresh for an authentication retry. | | [ClientAssertionProvider](/docs/auth/api/type-aliases/ClientAssertionProvider) | Creates a client assertion, typically regenerated for each token refresh. | | [TokenExchangeSubjectTokenType](/docs/auth/api/type-aliases/TokenExchangeSubjectTokenType) | Subject-token types supported by Salesforce OAuth token exchange. | | [SalesforceClientAssertionOptions](/docs/auth/api/type-aliases/SalesforceClientAssertionOptions) | Client-assertion credentials accepted by SalesforceAuth. |