How to authenticate when sending data to Salesforce [closed]

Question

This should be an easy question, but for some reason I have found some difficulty in finding resources that help with our simple use case:

Company A (does not use SalesForce) has data that they wish to send periodically to Company B's Salesforce. Company A will send the data using any format needed to fit Salesforce's data structures. Ideally this would be done via a REST API. Company B has created a connected app on their SF and provided Company A with the consumer key and secret. The problem is that sending data via the rest API using the consumer key and secret also requires an SF username and password for OAuth. Should Company B create a user account for Company A in addition to the consumer and secret for this type of integration to work? I went over the SF REST API docs but wasn't able to clarify. Specifically here:

In your client application, redirect the user to the appropriate Salesforce authorization endpoint. On successful user login, Salesforce calls your redirect URI with an authorization code. You use the authorization code in the next step to get the access token.

In our workflow, the user is not part of the process. Company A will have a backend process that will periodically format the data and send it to Company B.

Thank you.

Answer 1

What you have described is a "classic" integration scenario. While this can be achieved either using P2P (point to point) or having an ETL in place while using either SOAP or REST API but for any of the mechanism to be able to interact with data, it does go through two step process:

1. Authenticate the User (to make sure this is the right user to access the system)
2. Authorize the User (to allow user access to the appropriate resources after successful authentication)

Now coming to REST APIs, if you see this excerpt from the documentation, it states:

Before making REST API calls, you must authenticate the application user using OAuth 2.0

That signifies that while you can use REST APIs to make calls to access resources, you need to be authenticated first. And for any sort of authentication, you need to have a user credential set for the process (front end user login process or backend user login process) which is authenticating itself in Salesforce.

Why connected app? Because REST APIs authenticate to Salesforce using OAuth 2.0 and that the platform feature to integrate other systems to Salesforce using APIs is facilitated through connected apps.

A connected app integrates an application with Salesforce using APIs. Connected apps use standard SAML and OAuth protocols to authenticate, provide single sign-on, and provide tokens for use with Salesforce APIs. In addition to standard OAuth capabilities, connected apps allow Salesforce admins to set various security policies and have explicit control over who can use the corresponding apps.

If you see this, the process of being able to access a connected app is what is typically the authentication flow and that's where a user credential is required. Once authenticated, it then provides the token to be able to be used by the caller for further requests. And that the level of access is determined within the connected app and the profile with which the user is set up.

Summing this up, in your use case scenario:

1. Company B needs to setup a user for Company A - which usually we call as Integration User with the necessary profile permissions. This profile typically is setup with the API user permission.
2. Company B needs to create a connected app (because you are choosing to integrate using REST API) and provide the client secret and key to Company A
3. Company A needs to authenticate to Salesforce using the user credentials, the client secret and key
4. Company A then uses the authorized access token received after authentication for further requests