# OAuth 2.0 for First-Party Applications (/docs/auth/flows/first-party-applications)



Salesforce's OAuth 2.0 for First-Party Applications flows use
`/services/oauth2/v1/authorization_challenge` for private Experience Cloud
clients. `SalesforceAuth.firstPartyAuthorizationChallenge()` exposes the shared
endpoint while keeping each supported journey in its own guide.

<SalesforceReference title="Configure Headless Identity Flows with OAuth 2.0 for First-Party Applications" href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_identity_auth_challenge_parent.htm&language=en_US" />

## Choose a first-party flow [#choose-a-first-party-flow]

* [Username-password](/docs/auth/flows/first-party-username-password) for a first-party app that collects the user's username/password and receives an authorization code.
* [Passwordless login](/docs/auth/flows/first-party-passwordless) for email/SMS OTP login.
* [Registration](/docs/auth/flows/first-party-registration) for first-party headless user registration and verification.

These Salesforce flows require a private client and a client attestation JWT.
Salesforce also strongly ties them to PKCE and external client app configuration.

<SalesforceReference title="Configure an External Client App for Headless Identity Flows" href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_eca_auth_challenge.htm&language=en_US&type=5" />

## Shared Kysoql behavior [#shared-kysoql-behavior]

`auth.firstPartyAuthorizationChallenge()` returns either an authorized result
with an authorization code or a resumable challenge containing `authSession`,
Salesforce's error/status fields, and the flow-specific response payload.

After Salesforce returns an authorization code, exchange it with
[`auth.exchangeAuthorizationCode()`](/docs/auth/flows/web-server-pkce) against the same
Experience Cloud site base URL.