I am trying to build an integration solution for my clients to pull their Contacts and Leads into our system. When I tried to look up the Salesforce API, all the documentation seem to require our clients to set up a connected app, and give us the oauth token to pull data. However, my clients also told me that all their existing integrations (e.g. marketo) are done through installing from the SF App Exchange, and they needed to provide a user token, username and password to marketo. This seems quite different from the connected app approach. I am confused about which option I should pick. Could someone clarify this for me?
2 Answers
The AppExchange is a directory listing of apps that can be installed or used with Salesforce. You can choose to be listed or not. Listing yourself on the AppExchange enhances your product's visibility, and can provide a greater level of assurance with subscribers by going through a verification process called a Security Review.
There are a few ways to authenticate with an external application in Salesforce, one of the most common ways being a Connected App. A Connected App typically uses OAuth or the Canvas API to establish a secure connection between Salesforce and the external system. Even better, using a Connected App means you do not have to worry about authentication, such as storing your subscribers' passwords anywhere.
To be clear, your subscribers do not create a Connected App; you do. By doing this, subscribers that are trying to log in your system can identify which system they're logging in to by way of a custom logo and a set of permissions being granted. Here's an image of logging in to DocuSign (explained further in this question):
As you can see, the user gets visual confirmation that they're logging in to DocuSign, and granting access to DocuSign to use their Salesforce data by clicking the "Allow" button.
The Connected App includes some specific data that identifies your app from other apps your subscribers may also have installed or be connected to, and allows administrators to grant access for certain users to the app, etc.
By using a Connected App, you do not need to manage subscribers' user names and passwords, simplifying your security requirements. Also, if your app becomes compromised, the Connected App provides a way to disconnect all rogue agents at once (by changing the Connected Apps attributes).
-
Thanks for the explanation. So for simple use cases like exporting my clients' Salesforce records into our (3rd party) system, connected app would work? I just need to set up a connected app on my org's salesforce account, they don't have to do it?– PigCommented Dec 5, 2017 at 16:41
-
@Pig Correct. Your subscribers would connect to it, and then your app can use that connection. It'll probably make sense once you start using it and read more. Also see trailhead.salesforce.com/en/projects/workshop-electric-imp/….– sfdcfox ♦Commented Dec 5, 2017 at 16:53
Appexchange - natively built app on salesforce platform which can be installed in your salesforce org with just one click. It doesn't require any kind of authentication.
Integration - this means you are trying to interact with another system(or vice versa) which is not on salesforce platform. Therefore, you need to have an identifier to authenticate this external org to perform any sort of operation. Connected app would last this external application and provides you client secret and consumer key which helps salesforce determine a valid user connection over api's call.
How this helps.
