---
editLink: false
lastUpdated: false
---

[@salesforce/b2c-tooling-sdk](../../modules.md) / [auth](../index.md) / PkceOAuthStrategy

# Class: PkceOAuthStrategy

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:154](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L154)

OAuth 2.0 Authorization Code Flow with PKCE.

Used for public clients (no client secret). Replaces the legacy implicit flow,
which is deprecated for public clients per OAuth 2.1.

Flow:
1. Generate PKCE verifier + S256 challenge.
2. Open browser to `/dwsso/oauth2/authorize?response_type=code&code_challenge=...`.
3. Capture redirect with `?code=...` on a localhost listener.
4. POST `grant_type=authorization_code` + `code_verifier` to `/dwsso/oauth2/access_token`.

Tokens may include a refresh_token (depends on client registration in Account Manager).

## Implements

- [`AuthStrategy`](../interfaces/AuthStrategy.md)

## Constructors

### Constructor

> **new PkceOAuthStrategy**(`config`): `PkceOAuthStrategy`

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:165](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L165)

#### Parameters

##### config

[`PkceOAuthConfig`](../interfaces/PkceOAuthConfig.md)

#### Returns

`PkceOAuthStrategy`

## Properties

### authMethod

> `readonly` **authMethod**: `"user"`

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:155](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L155)

## Methods

### fetch()

> **fetch**(`url`, `init`): `Promise`\<`Response`\>

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:211](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L211)

Performs a fetch request with authentication.
Implementations MUST handle header injection and 401 retries (token refresh) internally.

#### Parameters

##### url

`string`

##### init

[`FetchInit`](../type-aliases/FetchInit.md) = `{}`

#### Returns

`Promise`\<`Response`\>

#### Implementation of

[`AuthStrategy`](../interfaces/AuthStrategy.md).[`fetch`](../interfaces/AuthStrategy.md#fetch)

***

### getAuthorizationHeader()

> **getAuthorizationHeader**(): `Promise`\<`string`\>

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:240](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L240)

Optional: Helper for legacy clients (like a strict WebDAV lib) that need the raw header.

#### Returns

`Promise`\<`string`\>

#### Implementation of

[`AuthStrategy`](../interfaces/AuthStrategy.md).[`getAuthorizationHeader`](../interfaces/AuthStrategy.md#getauthorizationheader)

***

### getJWT()

> **getJWT**(): `Promise`\<[`DecodedJWT`](../interfaces/DecodedJWT.md)\>

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:245](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L245)

#### Returns

`Promise`\<[`DecodedJWT`](../interfaces/DecodedJWT.md)\>

***

### getTokenResponse()

> **getTokenResponse**(): `Promise`\<[`AccessTokenResponse`](../interfaces/AccessTokenResponse.md)\>

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:250](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L250)

#### Returns

`Promise`\<[`AccessTokenResponse`](../interfaces/AccessTokenResponse.md)\>

***

### invalidateToken()

> **invalidateToken**(): `void`

Defined in: [packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts:265](https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/blob/2feab01f654eec77c6d702777ec2818472f131f1/packages/b2c-tooling-sdk/src/auth/oauth-pkce.ts#L265)

Optional: Invalidates the cached token, forcing re-authentication on next request.
Used by middleware to retry requests after receiving a 401 response.

#### Returns

`void`

#### Implementation of

[`AuthStrategy`](../interfaces/AuthStrategy.md).[`invalidateToken`](../interfaces/AuthStrategy.md#invalidatetoken)