Client credentials

Client credentials is a non-interactive server-to-server flow. Salesforce maps the external client app to a configured integration user and exchanges the client ID and client secret for an access token.

AuthenticateCopy Anchor Link

import { SalesforceAuth } from "@kysoql/auth";

export function authenticateService(clientId: string, clientSecret: string) {
  const auth = new SalesforceAuth({
    loginUrl: "https://example.my.salesforce.com",
    clientId,
  });

  return auth.clientCredentials({
    clientSecret,
    clientSecretTransport: "basic",
  });
}

Use the Salesforce My Domain configured for the integration. Kysoql rejects the generic login.salesforce.com and test.salesforce.com hosts for this grant.

Salesforce accepts the client credentials in the POST body or through HTTP Basic. Kysoql defaults to POST-body credentials. Set clientSecretTransport: "basic" for the Basic form.

This flow does not depend on a refresh token. Request a new access token with the client credentials when the existing token is no longer usable.