If the external system is a financial organization and doesn't like to share its credentials like username and password and other details like consumer key and secret key. In such cases how can we do the callout using RestAPI.

I heard it can be done using site certificate. Can someone share their thoughts and material if possible?

1 Answer 1


If the external system supports the OAUTH2 JWT Bearer Token, then the interaction can be secured by a pre-registered certificate. That flow is described in e.g. Digging Deeper into OAuth 2.0 on Force.com (its one of the later flows in the page) assuming an external application is calling into Salesforce.

But in your case I think you are saying you want to call out from Salesforce. This code An Apex implementation of the OAuth 2.0 JWT Bearer Token Flow supports that, but you may encounter a problem trying to find matching encryption algorithms at both ends.

  • After going through the articles What I understood is Target Org will provide a certificate to the source org and the source org will upload into static resources and refer the certificate in the http req, Correct me If I am wrong.
    – Suresh
    Mar 15, 2016 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .