Generate the Access Token and Frontdoor URL for Tableau Next Embedding

1import express from 'express';
2import crypto from 'crypto';
3
4const app = express();
5
6// --- Configuration --------------------------------------------------------
7const LOGIN_URL     = 'https://<your-salesforce-org>';                 // e.g. https://login.salesforce.com or your My Domain
8const CLIENT_ID     = '<client_id_from_your_External_Client_App>';
9const CLIENT_SECRET = '<client_secret_from_your_External_Client_App>'; // optional — only set if "Require Secret for Web Server Flow" is enabled
10const REDIRECT_URI  = 'https://<your-app-host>/getAccessToken';        // must match the External Client App's callback URL
11
12// --- PKCE helpers (RFC 7636, S256) ----------------------------------------
13// Only needed if the ECA has "Require Proof Key for Code Exchange (PKCE)
14// extension for Supported Authorization Flows" enabled. Remove these lines if your ECA 
15// doesn't require PKCE.
16function generatePkce() {
17  const codeVerifier  = crypto.randomBytes(96).toString('base64url');
18  const codeChallenge = crypto.createHash('sha256')
19                              .update(codeVerifier)
20                              .digest()
21                              .toString('base64url');
22  return { codeVerifier, codeChallenge };
23}
24
25// --- Step 1: Redirect the user to Salesforce's authorization endpoint -----
26app.get('/oauth2/auth', (req, res) => {
27  const params = new URLSearchParams({
28    response_type: 'code',
29    client_id: CLIENT_ID,
30    redirect_uri: REDIRECT_URI,
31    scope: 'api refresh_token lightning web'
32  });
33
34  // Add PKCE parameters only if the ECA's "Require Proof Key for Code Exchange" policy is enabled. 
35  // Remove these lines if your ECA doesn't require PKCE.
36  const { codeVerifier, codeChallenge } = generatePkce();
37  req.session.codeVerifier = codeVerifier; // keep verifier server-side for Step 2
38  params.append('code_challenge', codeChallenge);
39  params.append('code_challenge_method', 'S256');
40
41  res.redirect(`${LOGIN_URL}/services/oauth2/authorize?${params.toString()}`);
42});
43
44// --- Step 2: Exchange the authorization code for an access token ----------
45app.get('/getAccessToken', async (req, res) => {
46  const { code } = req.query;
47  if (!code) {
48    return res.status(400).json({ error: 'Missing authorization code' });
49  }
50
51  const params = new URLSearchParams({
52    grant_type: 'authorization_code',
53    client_id: CLIENT_ID,
54    redirect_uri: REDIRECT_URI,
55    code: String(code)
56  });
57
58  // Send the PKCE verifier only when PKCE was used in Step 1.
59  if (req.session.codeVerifier) {
60    params.append('code_verifier', String(req.session.codeVerifier));
61  }
62
63  // Send client_secret only when the ECA has "Require Secret for Web Server Flow" enabled
64  // (for example, managed ECAs with enhanced security settings).
65  if (CLIENT_SECRET) {
66    params.append('client_secret', CLIENT_SECRET);
67  }
68
69  const tokenResponse = await fetch(`${LOGIN_URL}/services/oauth2/token`, {
70    method: 'POST',
71    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
72    body: params.toString()
73  });
74
75  if (!tokenResponse.ok) {
76    return res.status(500).json({ error: 'Token exchange failed', details: await tokenResponse.text() });
77  }
78
79  const { access_token, instance_url } = await tokenResponse.json();
80  // Use access_token + instance_url to generate the frontdoor URL (see next section).
81  res.json({ access_token, instance_url });
82});

1const getFrontdoorUrl = async (accessToken: string, instanceUrl: string) => {
2  try {
3    const frontdoorEndpoint = `${instanceUrl}/services/oauth2/singleaccess`;
4
5    const myHeaders = new Headers();
6    myHeaders.append('accept', 'application/json');
7    myHeaders.append('authorization', `Bearer ${accessToken}`);
8    myHeaders.append('content-type', 'application/x-www-form-urlencoded');
9
10    const urlencoded = new URLSearchParams();
11
12    const requestOptions = {
13      method: 'POST',
14      headers: myHeaders,
15      body: urlencoded
16    };
17
18    const response = await fetch(frontdoorEndpoint, requestOptions);
19    if (!response.ok) {
20      return {error: `Salesforce API responded with ${response.status}`, statusCode: response.status};
21    }
22    const responseData = await response.json();
23    return {frontdoorUrl: responseData.frontdoor_uri};
24  } catch (error) {
25    // eslint-disable-next-line no-console
26    console.error('Error in getFrontdoorUrl:', error);
27    return {error: error.message || 'Failed to generate frontdoor URL'};
28  }
29};