Headless Identity Implementation Guide

What Is Headless Identity?
Complete Prerequisites for Headless Identity
Create a Role to Manage Headless Identity Features
Assign the Headless Identity Admin Role to Yourself
Set Up a Demo Profile for End Users
Set Up Cross-Origin Resource Sharing (CORS)
Create an Account for End Users
Enable the Authorization Code and Credentials Flow
Implement reCAPTCHA on a Web App
Set Up an Authentication Provider for Single Sign-On
Set Up an Experience Cloud Site for Headless Identity
Set Up an External Client App for Headless Identity
Use Postman to Work with Headless Identity APIs
JavaScript Examples for Headless Identity APIs
PDF

Note: This release is in preview. Features described here don’t become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can’t guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.

Implement reCAPTCHA on a Web App

For the Headless Registration Flow and the Headless Forgot Password Flow, you must configure at least one of two security settings on the Experience Cloud Login & Registration page. These settings add requirements to the requests that your app sends to Headless Identity APIs. You can require your app to send an access token issued to an internal integration user. Or you can require your app to send a reCAPTCHA token. For single-page apps, because you can’t keep the integration user’s access token private in the browser, we recommend that you require your app to send a reCAPTCHA token instead. Requiring reCAPTCHA helps you filter out invalid requests, such as requests from bots. To work with the Headless Identity API Postman collection, you must have a valid reCAPTCHA token.
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: Enterprise, Unlimited, and Developer Editions

Though full-blown instructions for implementing reCAPTCHA are outside the scope of this guide, we show you where to go and what information you need. Salesforce supports reCAPTCHA v2 and reCAPTCHA v3 for Headless Identity. For this example, we use reCAPTCHA v3.

To get a reCAPTCHA token, you must set up and host reCAPTCHA on a web app. In production, you implement reCAPTCHA on your off-platform app.

For this example, if you don’t have a test web app in mind, you can create one using Heroku—you can try a basic account for free.

To implement reCAPTCHA, see reCAPTCHA v3 in the reCAPTCHA Developer’s Guide at https://developers.google.com/recaptcha/docs/v3.

When you set up reCAPTCHA for this example, follow these guidelines.

  • For the domain, enter the URL for your web app, such as https://www.myapp.com.
  • For reCAPTCHA type, choose reCAPTCHA v3.
  • Note your API key pair, which you use later in this guide.
  • Ensure that you can get a reCAPTCHA token before you move on.