OmniStudioAdvancedauthenticationguestexperience-cloud
Implement OmniScript authentication and guest user patterns
Real World Scenario
Public quote OmniScript on Experience Cloud must protect pricing APIs from anonymous abuse while allowing guest quotes.
Expected Answer
• Guest user OmniScript with CAPTCHA on submit for bot prevention
• Rate limit IP calls from guest context via custom throttling Apex wrapper
• Progressive authentication before binding quote to account
• No sensitive data in OmniScript client-side JSON visible in browser devtools
• Session timeout and resume token security
• Separate authenticated agent OmniScript with elevated IP actions
• Security review guest-accessible DR fields minimum exposure
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Guest user OmniScript with CAPTCHA on submit for bot prevention Also consider: Rate limit IP calls from guest context via custom throttling Apex wrapper In practice: Progressive authentication before binding quote to account Optimize for scale and operational observability.
Architect Perspective
Guest OmniScript is public attack surface—minimize IP power and rate limit aggressively.