@salesforce/b2c-tooling-sdk / auth / PkceOAuthStrategy

Class: PkceOAuthStrategy

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:154

OAuth 2.0 Authorization Code Flow with PKCE.

Used for public clients (no client secret). Replaces the legacy implicit flow, which is deprecated for public clients per OAuth 2.1.

Flow:

1. Generate PKCE verifier + S256 challenge.
2. Open browser to /dwsso/oauth2/authorize?response_type=code&code_challenge=....
3. Capture redirect with ?code=... on a localhost listener.
4. POST grant_type=authorization_code + code_verifier to /dwsso/oauth2/access_token.

Tokens may include a refresh_token (depends on client registration in Account Manager).

Implements

• AuthStrategy

Constructors

Constructor

new PkceOAuthStrategy(config): PkceOAuthStrategy

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:165

Parameters

config

PkceOAuthConfig

Returns

PkceOAuthStrategy

Properties

authMethod

readonly authMethod: "user"

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:155

Methods

fetch()

fetch(url, init): Promise<Response>

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:211

Performs a fetch request with authentication. Implementations MUST handle header injection and 401 retries (token refresh) internally.

Parameters

url

string

init

FetchInit = {}

Returns

Promise<Response>

Implementation of

AuthStrategy.fetch

---

getAuthorizationHeader()

getAuthorizationHeader(): Promise<string>

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:240

Optional: Helper for legacy clients (like a strict WebDAV lib) that need the raw header.

Returns

Promise<string>

Implementation of

AuthStrategy.getAuthorizationHeader

---

getJWT()

getJWT(): Promise<DecodedJWT>

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:245

Returns

Promise<DecodedJWT>

---

getTokenResponse()

getTokenResponse(): Promise<AccessTokenResponse>

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:250

Returns

Promise<AccessTokenResponse>

---

invalidateToken()

invalidateToken(): void

Defined in: packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:265

Optional: Invalidates the cached token, forcing re-authentication on next request. Used by middleware to retry requests after receiving a 401 response.

Returns

void

Implementation of

AuthStrategy.invalidateToken