# Client credentials (/docs/auth/flows/client-credentials)



Client credentials is a non-interactive server-to-server flow. Salesforce maps
the external client app to a configured integration user and exchanges the
client ID and client secret for an access token.

<SalesforceReference title="OAuth 2.0 Client Credentials Flow for Server-to-Server Integration" href="https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_client_credentials_flow.htm&language=en_US&type=5" />

## Authenticate [#authenticate]

```ts
import { SalesforceAuth } from "@kysoql/auth";

export function authenticateService(clientId: string, clientSecret: string) {
  const auth = new SalesforceAuth({
    loginUrl: "https://example.my.salesforce.com",
    clientId,
  });

  return auth.clientCredentials({
    clientSecret,
    clientSecretTransport: "basic",
  });
}
```

Use the Salesforce My Domain configured for the integration. Kysoql rejects the
generic `login.salesforce.com` and `test.salesforce.com` hosts for this grant.

Salesforce accepts the client credentials in the POST body or through HTTP Basic.
Kysoql defaults to POST-body credentials. Set `clientSecretTransport: "basic"`
for the Basic form.

<SalesforceReference title="Configure a Client Credentials Flow" href="https://help.salesforce.com/s/articleView?id=configure_client_credentials_flow_for_external_client_apps.htm&language=en_US&type=5" />

This flow does not depend on a refresh token. Request a new access token with the
client credentials when the existing token is no longer usable.