KysoqlAuthentication flows
Device flow
Use Salesforce OAuth 2.0 device authorization for CLI and constrained-input clients.
The device flow is intended for clients that cannot conveniently host an interactive browser login, such as constrained-input devices and some CLI tools. The user authorizes the application in a separate browser while the client polls for completion.
Request a device code
import { SalesforceAuth } from "@kysoql/auth";
export function beginDeviceAuthorization() {
const auth = new SalesforceAuth({
loginUrl: "https://login.salesforce.com",
clientId: "external-client-app-id",
});
return auth.requestDeviceAuthorization({
scope: ["api"],
redirectUri: "http://127.0.0.1:1717/callback",
});
}The response contains the device code, user code, verification URI, polling interval, and any expiry returned by Salesforce. Display the verification URI and user code to the user.
Poll once
import { SalesforceAuth, SalesforceOAuthError } from "@kysoql/auth";
const auth = new SalesforceAuth({
loginUrl: "https://login.salesforce.com",
clientId: "external-client-app-id",
});
export async function pollOnce(deviceCode: string) {
try {
return await auth.pollDeviceAuthorization({ deviceCode });
} catch (error: unknown) {
if (
error instanceof SalesforceOAuthError &&
(error.code === "authorization_pending" || error.code === "slow_down")
) {
return undefined;
}
throw error;
}
}auth.pollDeviceAuthorization() performs one poll only. The application owns the
schedule and must respect Salesforce's returned interval and slow_down
responses.