@salesforce/b2c-tooling-sdk / auth / OAuthStrategy
Class: OAuthStrategy
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:172
OAuth 2.0 Client Credentials authentication strategy.
Implements the client credentials flow for automated/server-side authentication with no user interaction required. Automatically manages token caching, expiration, and 401 retry logic with single-flight token requests to prevent thundering herd on the token endpoint.
Example
import { OAuthStrategy } from '@salesforce/b2c-tooling-sdk';
const auth = new OAuthStrategy({
clientId: 'your-client-id',
clientSecret: 'your-client-secret',
scopes: ['sfcc.products'],
});
const response = await auth.fetch('https://api.example.com/products');Implements
Constructors
Constructor
new OAuthStrategy(
config):OAuthStrategy
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:183
Creates a new OAuthStrategy instance with the provided OAuth configuration.
Parameters
config
OAuth client credentials and optional configuration
Returns
OAuthStrategy
Methods
fetch()
fetch(
url,init):Promise<Response>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:211
Performs a fetch request with OAuth bearer token authentication.
Automatically injects the Authorization header and client ID header with a valid access token. Implements 401 retry logic: if a previously-successful request returns 401, invalidates the cached token and retries once with a fresh token. Does not retry on initial 401 to avoid retrying with bad credentials.
Parameters
url
string
The URL to fetch
init
FetchInit = {}
Optional fetch init options (headers, body, method, etc.)
Returns
Promise<Response>
The fetch response
Implementation of
getAccessTokenForCascade()
getAccessTokenForCascade(
candidates):Promise<string>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:315
Resolves a scope cascade. See AuthStrategy.getAccessTokenForCascade.
Each candidate is merged with this strategy's base scopes (e.g. tenant scope baked in via withAdditionalScopes) before being sent to AM.
Cache strategy:
- For each candidate, scan the cache for any non-expired token whose scopes ⊇ (base ∪ candidate). First hit wins, no AM call.
- On miss, request each candidate from AM in order. Cache successes.
- On
invalid_scopefor a candidate, continue to the next candidate. On any other error, rethrow.
Parameters
candidates
string[][]
Returns
Promise<string>
Implementation of
AuthStrategy.getAccessTokenForCascade
getAuthorizationHeader()
getAuthorizationHeader():
Promise<string>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:240
Optional: Helper for legacy clients (like a strict WebDAV lib) that need the raw header.
Returns
Promise<string>
Implementation of
AuthStrategy.getAuthorizationHeader
getJWT()
getJWT():
Promise<DecodedJWT>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:248
Gets the decoded JWT payload
Returns
Promise<DecodedJWT>
getTokenResponse()
getTokenResponse(
signal?):Promise<AccessTokenResponse>
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:257
Gets the full token response including expiration and scopes. Useful for commands that need to display or return token metadata.
Parameters
signal?
AbortSignal
Returns
Promise<AccessTokenResponse>
invalidateToken()
invalidateToken():
void
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:283
Invalidates cached tokens, forcing re-authentication on next request.
Clears every token for this client/method/AM-host identity — not just the base-scope key — so a 401 retry can't re-use a rejected token that was cached under a merged cascade-scope key.
Returns
void
Implementation of
withAdditionalScopes()
withAdditionalScopes(
additionalScopes):OAuthStrategy
Defined in: packages/b2c-tooling-sdk/src/auth/oauth.ts:294
Creates a new OAuthStrategy with additional scopes merged in. Used by clients that have specific scope requirements.
Parameters
additionalScopes
string[]
Scopes to add to this strategy's existing scopes
Returns
OAuthStrategy
A new OAuthStrategy instance with merged scopes