I'm looking at building some additional integration between salesforce and a third party server as part of an ISV project, working across all editions including group and professional.

Currently the third party server calls salesforce using OAuth with the scope of "id" and "chatter_api" (via a connected app). The additional integration requirements cannot be done with just the chatter api so I'm looking at building some APEX REST APIs and get them whitelisted via the appexchange/isv program.

If I get them whitelisted how will this effect the scope of existing OAuth/Connected Apps?

  • no effect at all (id + chatter_api is still ok)
  • need to change scope to ( id + api ) as now accessing more than chatter api

I'm keen to avoid changing the scope to id + api as this may be seen as less secure as the third party server can now access a lot more objects within salesforce, which some salesforce customers might get nervous about.

1 Answer 1


You will need ( id + chatter_api + api ) scope, since that's the access your app will need. Even if you are ISV whitelisted, your scope must reflect the necessary access.

BTW - although api includes chatter_api, and you don't even need to separately specify id, since it's implicit in all the other scopes, it's good practice to list out the scopes your app is planning to use, just to make things explicit.

  • Thanks @metadaddy not the answer I was hoping for due to the perceived security risk by salesforce customers but understand why this is the case. Commented Mar 27, 2013 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .