# TokenExchangeOptions (/docs/auth/api/interfaces/TokenExchangeOptions)



[@kysoql/auth](/docs/auth/api) / TokenExchangeOptions

Options for Salesforce OAuth 2.0 token exchange.

## Extends [#extends]

* `TokenEndpointOptions`.`OAuthClientAuthentication`

## Properties [#properties]

| Property                                                               | Modifier   | Type                                                                                         | Description                                                                        | Inherited from                                    |
| ---------------------------------------------------------------------- | ---------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------- |
| <a id="api-property-clientid" /> `clientId`                            | `readonly` | `string`                                                                                     | Connected App consumer key / OAuth client ID.                                      | -                                                 |
| <a id="api-property-subjecttoken" /> `subjectToken`                    | `readonly` | `string`                                                                                     | Token being exchanged.                                                             | -                                                 |
| <a id="api-property-subjecttokentype" /> `subjectTokenType`            | `readonly` | [`TokenExchangeSubjectTokenType`](/docs/auth/api/type-aliases/TokenExchangeSubjectTokenType) | RFC token-type identifier describing `subjectToken`.                               | -                                                 |
| <a id="api-property-scope" /> `scope?`                                 | `readonly` | `string` \| readonly `string`\[]                                                             | Scopes requested for the exchanged token.                                          | -                                                 |
| <a id="api-property-tokenhandler" /> `tokenHandler?`                   | `readonly` | `string`                                                                                     | Salesforce token-handler URL or identifier used for token exchange, when required. | -                                                 |
| <a id="api-property-loginurl" /> `loginUrl`                            | `readonly` | `string`                                                                                     | Salesforce login or My Domain base URL for the token endpoint.                     | `TokenEndpointOptions.loginUrl`                   |
| <a id="api-property-refreshtokenstore" /> `refreshTokenStore?`         | `readonly` | [`RefreshTokenStore`](/docs/auth/api/interfaces/RefreshTokenStore)                           | Persist a newly issued/rotated refresh token before returning the session.         | `TokenEndpointOptions.refreshTokenStore`          |
| <a id="api-property-signal" /> `signal?`                               | `readonly` | `AbortSignal`                                                                                | Cancels this request.                                                              | `TokenEndpointOptions.signal`                     |
| <a id="api-property-timeoutms" /> `timeoutMs?`                         | `readonly` | `number`                                                                                     | Per HTTP request. Default: 30 seconds.                                             | `TokenEndpointOptions.timeoutMs`                  |
| <a id="api-property-fetch" /> `fetch?`                                 | `readonly` | (`input`, `init?`) => `Promise`\<`Response`>                                                 | Native fetch by default. Primarily useful for tests and custom runtimes.           | `TokenEndpointOptions.fetch`                      |
| <a id="api-property-clientsecret" /> `clientSecret?`                   | `readonly` | `string`                                                                                     | Use only from a confidential client that can keep this secret.                     | `OAuthClientAuthentication.clientSecret`          |
| <a id="api-property-clientassertion" /> `clientAssertion?`             | `readonly` | `string`                                                                                     | JWT client assertion accepted by Salesforce instead of clientSecret.               | `OAuthClientAuthentication.clientAssertion`       |
| <a id="api-property-clientsecrettransport" /> `clientSecretTransport?` | `readonly` | `"body"` \| `"basic"`                                                                        | Default: body. Salesforce also accepts HTTP Basic for client secrets.              | `OAuthClientAuthentication.clientSecretTransport` |