In Salesforce OAuth2.0 Web Server flow, there is an option to not require a client key. But I am not sure whether it supports OAuth 2.0 RFC 7636: https://oauth.net/2/pkce/, which is the PKCE validation. In the document it says:

It requires additional support by the authorization server, so it is only supported on certain providers.

I tried to search through Salesforce documents but didn't find anything related. And I don't see related code base regarding this validation as well. The most similar I have seen so far is this question on Salesforce forum: https://developer.salesforce.com/forums/?id=9060G0000005ag9QAA. But it is also unanswered.

Any thoughts about this one?

1 Answer 1


PKCE is an optional part of Web Server flow. From the docs:

code_challenge—Specifies the SHA256 hash value of the code_verifier value in the token request to help prevent authorization code interception attacks. [...]

If the code_challenge value is provided in the authorization request and a code_verifier value is provided in the token request, Salesforce compares the code_challenge to the code_verifier.

  • If the code_challenge is invalid or doesn’t match, the login fails with the invalid_request error code.
  • If the code_challenge value is provided in the authorization request, but a code_verifier value isn’t provided in the token request, the login fails with the invalid_grant error code.
  • Can this flow be done purely from the client of a web application? I ran into CORS issues trying to implement Web Server Flow (with or without PKCE) via a javascript POST request. Since Authorization Code with PKCE is now preferred over Implicit Grant, can this be done with Salesforce? Oct 30, 2019 at 22:00
  • 1
    @TracyMoody SF doesn't allow cross-origin requests on unauthenticated resources, including oAuth endpoints. It is possible to implement authorization code grant (aka Web Server flow) in SPA or similar client-heavy app but you'll have to be careful about these requests, e.g. issue a 302 redirect from JS to grab the authorization code rather than a cross-origin fully-submerged-no-user-interaction request in JS.
    – identigral
    Oct 30, 2019 at 22:25
  • 1
    Update: cross-origin requests on oAuth endpoints are allowed since Winter '21 release (Nov 2020)
    – identigral
    Apr 27, 2021 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.