Salesforce Certified Identity and Access Management Practice

Which client types are suitable for the user-agent flow?

1. Web browsers only

2. Server applications only

3. Client apps (consumers) that reside on the user's device or computer

4. Cloud-based applications

The correct answer is: Client apps (consumers) that reside on the user's device or computer

The user-agent flow is specifically designed to facilitate authorization for applications that run on a user's device, such as mobile apps or single-page applications. This flow is particularly suited for client applications that are directly interacting with the user, allowing them to authenticate seamlessly through a web-based interface. In this context, since the flow operates via the user's browser, it leverages the user-agent's capability to handle redirects and manage sessions securely. This enables the user to grant permissions or authorize requests directly in a user-friendly manner. Thus, client apps that reside on the user's device or computer are well-suited for this flow. While other types of applications can handle user authorization, they may employ different mechanisms tailored to their specific architectures, which do not utilize the direct user interaction through the browser in the same way as the user-agent flow does. For instance, server applications often perform authorization flows that are more suited to back-end processing, while cloud-based applications may utilize different strategies depending on their integration requirements.