new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Authentication · all subjects

social sign-on/salesforce

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Salesforce default scopes

The default scopes requested by the provider are openid, email, and profile. The provider automatically includes the id scope for accessing basic user information.

Salesforce OAuth setup: Connected App configuration

To set up Salesforce authentication, log into your Salesforce org (Production or Developer Edition), navigate to Setup > App Manager, and click New Connected App. Fill in the Connected App Name (your app name), API Name (auto-generated), and Contact Email (your email). Enable OAuth Settings by checking the Enable OAuth Settings checkbox. Set the Callback URL to your redirect URI (for example, http://localhost:3000/api/auth/callback/salesforce for development). Select Required OAuth Scopes: Access your basic information (id), Access your identity URL service (openid), Access your email address (email), and Perform requests on your behalf at any time (refresh_token, offline_access). Enable Require Proof Key for Code Exchange (PKCE) (this is required). Save and note your Consumer Key (Client ID) and Consumer Secret (Client Secret).

Salesforce callback URL must match exactly

The callback URL configured in your Salesforce Connected App must exactly match the callback URL configured in Better Auth. For development, you can use http://localhost:3000 URLs, but production requires HTTPS. The protocol (http:// vs https://), domain, port, and path must all match exactly.

Salesforce provider configuration in Better Auth

Configure the Salesforce provider by passing it to the socialProviders option of the auth instance. The configuration object accepts: clientId (your Connected App's Consumer Key, required), clientSecret (your Connected App's Consumer Secret, required), environment (either "production" as default or "sandbox"), loginUrl (custom My Domain URL without https://, optional, overrides environment setting), and redirectURI (optional override of the auto-generated redirect URI).

Salesforce provider configuration code example

import { betterAuth } from "better-auth" export const auth = betterAuth({ socialProviders: { salesforce: { clientId: process.env.SALESFORCE_CLIENT_ID as string, clientSecret: process.env.SALESFORCE_CLIENT_SECRET as string, environment: "production", // or "sandbox" }, }, })

Salesforce advanced provider configuration example

export const auth = betterAuth({ socialProviders: { salesforce: { clientId: process.env.SALESFORCE_CLIENT_ID as string, clientSecret: process.env.SALESFORCE_CLIENT_SECRET as string, environment: "sandbox", loginUrl: "my-company.my.salesforce.com", redirectURI: "http://localhost:3000/api/auth/callback/salesforce", }, }, })

Salesforce environment variables

Set the following environment variables: SALESFORCE_CLIENT_ID (your consumer key), SALESFORCE_CLIENT_SECRET (your consumer secret), and BETTER_AUTH_URL (http://localhost:3000 for development or https://yourdomain.com for production). The BETTER_AUTH_URL is important for redirect URI generation.

Salesforce sign-in using authClient

To sign in with Salesforce, use the signIn.social function from the auth client. Call authClient.signIn.social({ provider: "salesforce" }).

Salesforce sign-in code example

import { createAuthClient } from "better-auth/client" const authClient = createAuthClient() const signIn = async () => { const data = await authClient.signIn.social({ provider: "salesforce" }) }

Salesforce sandbox environment configuration

For sandbox testing, you can either create the Connected App in your sandbox org, or use the same Connected App and specify environment: "sandbox" in the provider configuration. When using environment: "sandbox", the provider will connect to test.salesforce.com instead of login.salesforce.com.

Salesforce PKCE is required and automatic

Salesforce requires PKCE (Proof Key for Code Exchange). You must enable PKCE in your Connected App settings. Better Auth automatically handles PKCE, so no additional configuration is needed on the application side.

Salesforce loginUrl for My Domain

The loginUrl option is useful for organizations with My Domain enabled. It should be the custom My Domain URL without the https:// protocol prefix (for example, my-company.my.salesforce.com). Using loginUrl overrides the environment setting.

Salesforce redirect URI mismatch troubleshooting

If you encounter a redirect_uri_mismatch error, check that the Callback URL in your Salesforce Connected App exactly matches your Better Auth callback URL. Verify that the protocol (http:// vs https://), domain, and port number all match. If needed, use the redirectURI option to explicitly set the redirect URI in the provider configuration.

Give your agent this brain