KysoqlAuthentication flows
Web-server authorization code with PKCE
Authorize Salesforce users with the OAuth 2.0 web-server flow and PKCE.
Use the web-server authorization-code flow for applications that redirect a user to Salesforce to authorize access. Kysoql supports PKCE and Salesforce's confidential-client authentication options for the code exchange.
Start authorization
import { SalesforceAuth } from "@kysoql/auth";
export async function beginAuthorization() {
const auth = new SalesforceAuth({
loginUrl: "https://login.salesforce.com",
clientId: "external-client-app-id",
});
const pkce = await auth.generatePkcePair();
const url = auth.authorizationUrl({
redirectUri: "https://app.example.com/oauth/callback",
scope: ["api", "refresh_token"],
state: crypto.randomUUID(),
codeChallenge: pkce.challenge,
});
return { url, verifier: pkce.verifier };
}Store the verifier with the browser/session state and validate your own state
value when Salesforce redirects back to the application.
Exchange the code
import { SalesforceAuth } from "@kysoql/auth";
export function exchangeCode(code: string, verifier: string) {
const auth = new SalesforceAuth({
loginUrl: "https://login.salesforce.com",
clientId: "external-client-app-id",
});
return auth.exchangeAuthorizationCode({
code,
redirectUri: "https://app.example.com/oauth/callback",
codeVerifier: verifier,
});
}A confidential client can also provide clientSecret, choose
clientSecretTransport: "basic", or supply a clientAssertion generated with
createOAuthClientAssertion().
If Salesforce returns a refresh token, persist rotation with the refresh-token flow and refresh-token storage.