IntegrationAdvancedoauthpkcemobile
Design OAuth PKCE flow for mobile Salesforce Experience Cloud integrations
Real World Scenario
Mobile app uses implicit OAuth flow; security audit mandates PKCE and prohibits client secret in app binary.
Expected Answer
• Authorization code flow with PKCE code_verifier code_challenge S256
• No client secret in mobile app public client
• Experience Cloud connected app enable PKCE required
• Deep link redirect custom URL scheme or universal link
• Refresh token secure storage iOS Keychain Android Keystore
• Token exchange short-lived access token rotate refresh
• Certificate pinning API calls optional high security
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Authorization code flow with PKCE code_verifier code_challenge S256 Also consider: No client secret in mobile app public client In practice: Experience Cloud connected app enable PKCE required Optimize for scale and operational observability.
Architect Perspective
Mobile OAuth without PKCE fails modern security audit—migrate from implicit flow immediately.