Is it possible to give a 3rd party application access to a custom webservice without giving them access to the standard API?
To give a little background on my project. Users will use their Salesforce credentials to login and register on one of our sister company's websites. Once they have logged into the site using their Salesforce credentials, the user needs the ability to pull down Salesforce data they own, such as customer information.
What we have built for this works great, but the issue is being able to restrict the users to the custom service. Our security team his holding up this project because of the additional access to the standard api.
Any thoughts on how to limit access to the custom service only?