I have built an app for the app exchange and have been looking into a way that users can log into their instance of Salesforce via a Chrome extension of some sort.

I am a little new to logging into Salesforce externally so I am not 100% up with the times on how this can be achieved...

I had a look into OAUTH, but it seems you need a client Id and Secret to be able to log in. I also looked into other things like using the Salesforce connection JS, but with this form what I gather you also need to have the Security token every time you need to log in.

Does anyone have any idea's of how to potentially get around this? I don't think the best way to go about this is to create a separate Chrome extension for each org that purchases the extension :/

  • You might consider passing username/pw as url params. A bit dirty but it works.
    – user28311
    Commented Feb 28, 2016 at 15:31

1 Answer 1


In the ideal world you would create a connected app, and then use OAuth and a refresh token to establish the session. This is a good approach, because your extension never needs to have the Salesforce users raw credentials. The security token won't be required.

Alternatively, you can use a stored username and password against the Partner API to perform the login. You will likely need the security token for this unless you have trusted the IP address the request is coming from.

Once you have a valid Session ID for the UI, you can use Frontdoor.jsp to drop the user into Salesforce. E.g.


If you want quick and dirty, you can login directly with the username and password directly on the query string. E.g.

https://www.salesforce.com/login.jsp?un=[[email protected]]&pw=[plaintextPassword]

  • Thanks for the above answer, I was wondering what will happen if I want users to be able to dynamically change the org they are working on. So will the approach of using ClientId and secret work in that case? or it will change for each different org. Thanks
    – SEuser
    Commented Mar 11, 2016 at 5:41
  • @KaushikRay A connected app can connect to other orgs it is configured in. You would still need to go through the OAuth steps. The only exception I think are sandbox orgs, where you need another connected app setup. Commented Mar 12, 2016 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .