Skip to content
SteveTechArcSteveTechArc Courses

OAuth: The Base Pattern

Chapter 8 of Securing Salesforce: Identity and Access, Part 2: Accepting and Providing Identity. New to the food festival? Start with the Front Door chapter, module 1.

So far in this course, people have signed in: directly, through an identity provider, or with Salesforce vouching for them. This chapter is about programs. An integration, a phone app, an agent: software that wants Salesforce’s data.

OAuth starts with one simple pattern. You don’t go straight to the stall. You go to the entrance first, present something, and get a wristband. Then you show the wristband at the stall. Learn that pattern, and three quarters of the OAuth flows look almost identical. What changes is what’s presented at the entrance.

The ideas in this chapter

Section titled “The ideas in this chapter”
  • Four roles: the resource owner, the client, the authorization server and the resource server. The same triangle as single sign-on, except the client walks over itself, with no browser in between.
  • Two steps, one address: every single-step flow posts to /services/oauth2/token on your My Domain.
  • How it began: a person’s username and password at the entrance. It’s the one thing OAuth set out to stop, and it retires on February 20, 2027.
  • Client credentials: the program’s own ID and secret, run as an integration user you choose, with no refresh token. Whoever has the secret can get a wristband.
  • Scopes are set on the app, never asked for. full is the keys to the whole farm, and client credentials can’t have it.
  • Two checks at the stall: the scope, then the user. A scope can’t give more than the user has.
  • The refresh token is a re-entry pass: the same request with a different pass, and only for flows with a person.
  • Once you know this one, the rest of the family is the same two steps with something different presented. The web server flow is the one that isn’t: chapter 9’s flip.

The picture

Section titled “The picture”

Here’s the chapter’s picture. It stays the same in every module; only what the client presents changes.

Don't go straight to the stall: the base pattern Three columns: the client, the entrance, Salesforce's token endpoint, and the stall, an API. Step 1: the client goes to the entrance and presents something, with a POST to /services/oauth2/token; the entrance checks what's presented and gives back the wristband, an access token. Step 2: the client goes to the stall and shows the wristband, a Bearer token, on every call; the stall checks the wristband, never the client's ID, and sends back the data. Footnote: two steps, always the same; what changes from flow to flow is what's presented at the entrance. {"author": "Steve Simpson", "blueprint": "1.0.0", "builder": "standard 1.58.0", "built": "2026-11-04", "id": "DGM-IAM-OF-01", "rights": "\u00a9 2026 Twinshark LLC. All rights reserved.", "template": "cells 0.5.0", "theme": "stevetecharc 1.4.0"} THE CLIENT THE ENTRANCE: SALESFORCE'S TOKEN ENDPOINT THE STALL: AN API 1. Goes to the entrance POST /services/oauth2/token, with something to present The entrance checks what's presented; gives out a wristband 2. Goes to the stall shows the wristband on every call The stall checks the wristband, never your ID presents something the wristband the wristband the data Two steps, always the same. What changes from flow to flow is what's presented at the entrance. HOW TO READ IT the entrance: where you prove who you are, once © 2026 Twinshark LLC · stevetecharc.com
Click to enlarge

The path through this chapter

Section titled “The path through this chapter”

Six modules, each standing on its own, and a practice.

  1. Don’t Go Straight to the Stall The four roles; no browser carrying messages; two steps; why bother with an entrance.
  2. How It Began The old school one; what the client sends; what’s wrong with it; when it ends; what to use instead.
  3. Client Credentials The same shape, the current form; the request; the answer, field by field; who it runs as; the secret is the entrance.
  4. What the Wristband Lets You Do Where scopes are set; a few in plain words; what client credentials can’t get; two checks at the stall.
  5. The Re-Entry Pass Two kinds of token; the same request, a different pass; which flows give one; why it needs care; taking it back.
  6. Once You Know This One Passing something different; the rest of the family; the one that’s different; what you can do now.

Then the practice: see scopes work, with client credentials, a narrow scope, a refused call, and a revoked token.

Check what stuck with the study guide.

Integration Architect tells the integration side of the same story in its chapter 13: one integration, one identity; choosing a flow; and tokens as a design decision.

What an architect decides here

Section titled “What an architect decides here”
  • What each integration presents at the entrance, and whether that proof belongs in that system.
  • The integration user each one runs as, with only the access it needs.
  • The scopes on each app, one app per job, never full for a program.
  • Where the client secret lives, and how it’s changed.
  • Which apps get a re-entry pass, with rotation on, and how tokens are taken back.
  • Which integrations still use the username-password flow, and when each moves.

Beyond the exam: what AI changes. An agent is another client at the entrance. What it presents, whose wristband it wears and what that wristband’s scopes allow are the same questions as for any integration, with higher stakes. Chapter 17 takes it further.

Explore

Section titled “Explore”

Each module lists its own sources, each checked 2026-11-07. Two to start with:

Next: The Burger House: Flows With a Person.

Follow Me

© 2023–2026 Twinshark LLC. All rights reserved. · Content Use

Privacy notice

SteveTechArc is independent and is not affiliated with, sponsored by, or endorsed by Salesforce, Inc. Salesforce and related marks are trademarks of Salesforce, Inc.

Educational content, shared as is. Not professional, legal or financial advice. Salesforce changes several times a year, so check current Salesforce documentation before you rely on any platform detail.