OAuth 2.0 for First-Party Applications

Salesforce's OAuth 2.0 for First-Party Applications flows use /services/oauth2/v1/authorization_challenge for private Experience Cloud clients. SalesforceAuth.firstPartyAuthorizationChallenge() exposes the shared endpoint while keeping each supported journey in its own guide.

Choose a first-party flowCopy Anchor Link

• Username-password for a first-party app that collects the user's username/password and receives an authorization code.
• Passwordless login for email/SMS OTP login.
• Registration for first-party headless user registration and verification.

These Salesforce flows require a private client and a client attestation JWT. Salesforce also strongly ties them to PKCE and external client app configuration.

Shared Kysoql behaviorCopy Anchor Link

auth.firstPartyAuthorizationChallenge() returns either an authorized result with an authorization code or a resumable challenge containing authSession, Salesforce's error/status fields, and the flow-specific response payload.

After Salesforce returns an authorization code, exchange it with auth.exchangeAuthorizationCode() against the same Experience Cloud site base URL.