Note: This release is in preview. Features described here don’t become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can’t guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.

OauthOidcSettings

Represents org settings for disabling OAuth OpenID Connect authorization flows.

Parent Type and Manifest Access

This type extends the Metadata metadata type and inherits its fullName field.

In the package manifest, all the settings metadata types for the org are accessed using the “Settings” name. See Settings for more details.

File Suffix and Directory Location

OauthOidcSettings values are stored in the OauthOidc.settings file in the settings folder. The .settings files are different from other named components, because there is only one settings file for each settings component.

Version

OauthOidcSettings is available in API version 56.0 and later.

Special Access Rules

There are no additional access requirements that are specific to this type.

Fields

Field Name	Description
agentAuthLinking	Field Type boolean Description For internal use only.
blockOAuthUnPwFlow	Field Type boolean Description Indicates whether the username-password flow is blocked (`true`) or not blocked (`false`). The default value is `false`.
blockOAuthUsrAgtFlow	Field Type boolean Description Indicates whether the user-agent flow is blocked (`true`) or not blocked (`false`). The default value is `false`.
enableHdlessFgtPswFlow	Field Type boolean Description For internal use only.
isPkceRequired	Field Type boolean Description Indicates whether the OAuth 2.0 Proof Key for Code Exchange (PKCE) security extension is required for variations of the OAuth authorization code flow that access this org (`true`) or not (`false`). This setting requires PKCE for all supported variations of the authorization code flow, including the web server flow, the Authorization Code and Credentials Flow, and their derivatives. The default value is `false`. This field is available in API version 59.0 and later.
oAuthCdCrdtFlowEnable	Field Type boolean Description Indicates whether the Authorization Code and Credentials Flow is enabled (`true`) or blocked (`false`). The default value is `false`.

Declarative Metadata Sample Definition

The following is an example of the OauthOidcSettings file.

1<?xml version=“1.0” encoding=“UTF-8"?>
2<OauthOidcSettings xmlns=“http://soap.sforce.com/2006/04/metadata”>
3    <blockOAuthUnPwFlow>true</blockOAuthUnPwFlow>
4    <blockOAuthUsrAgtFlow>true</blockOAuthUsrAgtFlow>
5    <oAuthCdCrdtFlowEnable>false</oAuthCdCrdtFlowEnable>
6</OauthOidcSettings>

Example Package Manifest

The following is an example package.xml that references the previous definition.

1<?xml version=“1.0" encoding=“UTF-8”?>
2<Package xmlns=“http://soap.sforce.com/2006/04/metadata”>
3  <types>
4    <members>OauthOidc</members>
5    <name>Settings</name>
6  </types>
7  <version>56.0</version>
8</Package>

Wildcard Support in the Manifest File

The wildcard character * (asterisk) in the package.xml manifest file doesn’t apply to metadata types for feature settings. The wildcard applies only when retrieving all settings, not for an individual setting. For details, see Settings. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.

Metadata API Developer Guide