What it is
OAuth 2.0 is an authorization framework, defined in RFC 6749, that lets an application obtain limited access to a service on a user’s behalf. The user signs in with the authorization server and approves the requested scopes; the application receives an access token for the resource server and never sees the user’s password. It defines several grant types for different kinds of client.
Why it matters
Almost every integration with Salesforce — a React app, a middleware platform, an AI agent — authenticates through OAuth. Choosing the right grant decides whether credentials can leak, whether access can be revoked per app, and whether a user or a service identity is accountable for what the integration does.
Key components
- Roles: resource owner, client, authorization server, resource server
- Authorization code grant (with PKCE) for user sign-in
- Client credentials grant for server-to-server access
- Refresh tokens for renewing access without re-prompting
- Scopes limiting what a token may do
How it connects
On Salesforce the client is registered as a Connected App or External Client App, which sets the allowed flows, scopes and policies. PKCE is the extension that makes the authorization code grant safe for public clients.
Good to know
OAuth is authorization, not authentication — it says what an app may do, not who the user is. OpenID Connect adds identity on top. The implicit grant and the password grant are deprecated by current security guidance.
Related terms
MCP (Model Context Protocol)
Anthropic's open standard for connecting AI models to external data sources and tools. Think of it as a universal adapter for AI.
Capability-Based Authorization
Authorizing an AI agent by granting narrow, revocable permissions for specific actions, rather than handing it a broad API key or a human's full access.
PKCE (Proof Key for Code Exchange)
An OAuth 2.0 extension (RFC 7636) that binds an authorization code to the client that requested it, so an intercepted code cannot be exchanged for tokens.
OAuth 2.0 in practice
Articles from the Funnelists Team that put this term to work.
Why Build-vs-Buy IT Leaders Decouple the Salesforce Frontend for Custom Customer Portals
Build-vs-Buy IT leaders are decoupling the Salesforce frontend to own the customer experience while keeping Salesforce as the secure, automated backend. Here is the decision framework they actually use.
Salesforce GraphQL API: Enabling Efficient Headless Architectures
Discover how Salesforce GraphQL API simplifies data access in headless setups, reduces over-fetching, and supports modern frontends with built-in security and mutations.