# Hybrid web-server (/docs/auth/flows/hybrid-web-server)



Use the hybrid web-server flow when a hybrid application needs Salesforce API
access together with direct Salesforce web-session management. For a service that
only executes REST/SOQL, the ordinary web-server flow is usually simpler.

<SalesforceReference title="OAuth 2.0 Hybrid Web Server Flow" href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_web_server_flow.htm&language=en_US&type=5" />

## Exchange the authorization code [#exchange-the-authorization-code]

```ts
import { SalesforceAuth } from "@kysoql/auth";

export function exchangeHybridCode(code: string) {
  const auth = new SalesforceAuth({
    loginUrl: "https://example.my.salesforce.com",
    clientId: "external-client-app-id",
  });

  return auth.exchangeHybridAuthorizationCode({
    code,
    redirectUri: "https://app.example.com/oauth/callback",
  });
}
```

The helper sends Salesforce's `hybrid_auth_code` grant. It supports the same
confidential-client authentication inputs as the normal authorization-code
exchange.

When the resulting hybrid session expires, use the separate
[hybrid refresh-token flow](/docs/auth/flows/hybrid-refresh-token).

Kysoql intentionally does not expose the retiring hybrid user-agent flow.