SAML bearer assertion

Use the OAuth 2.0 SAML bearer assertion flow when a trusted identity provider can issue the signed SAML assertion Salesforce expects for a previously authorized application.

Exchange the assertionCopy Anchor Link

import { SalesforceAuth } from "@kysoql/auth";

export function authenticateWithSamlBearer(
  loginUrl: string,
  samlAssertion: string,
) {
  const auth = new SalesforceAuth({
    loginUrl,
    clientId: "external-client-app-id",
  });
  return auth.samlBearer({ assertion: samlAssertion });
}

Kysoql does not create, sign, or validate SAML XML. Obtain the assertion from the application's configured identity provider and pass the encoded assertion to the exchange helper.

Salesforce does not issue a refresh token for this flow. Obtain a new SAML assertion and exchange it again when a new access token is required.

For Salesforce's separate SAML API federation flow, see SAML assertion.