Headless 360Beginneroauthsecurityauthentication
What is OAuth and why does headless need it?
Real World Scenario
Your mobile app must log users in without storing Salesforce passwords. You explain OAuth at a basic level.
Expected Answer
• OAuth lets users authorize an app to access Salesforce without sharing passwords
• Connected apps define client ID, secret, callback URLs, and scopes
• Flows like authorization code with PKCE are standard for mobile and SPAs
• Access tokens expire; refresh tokens extend sessions per policy
• Never embed long-lived admin tokens in client-side code
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Proof Key for Code Exchange adds security for public clients that cannot hide a secret, like mobile apps. Use it instead of legacy implicit flows.
Architect Perspective
Junior red flag: hardcoded credentials. Say PKCE + middleware in every auth answer.