Can protected custom settings be edited by the API?

Question

I'm preparing a managed package however I would like to store some protected custom settings that the user cannot see (access keys, and the like). I'd like These settings to be populated once the user completes the Oauth flow and authorizes my website to access their Salesforce data.

My question is, if I make the custom settings 'protected', will I still be able to populate the information in a subscriber organization managed package-type context? I'm doing this now by making a POST request with the subscriber's OAuth token to:

/services/data/v20.0/sobjects/MyCustomSetting__c/

Will this work once it's a managed package and deployed? If not, what are the alternatives?

Answer 1

I don't think protected custom setting can be accessed by any means outside of manage package code.See this answer.

Probably you can try to create some custom rest api methods in your manage package which you can call from external application through rest api and in those api methods probably you can assign values to custom setting

Answer 2

If you want you can use Post install script which can update the custom setting. Other then that API end point will not work here or another option is create a VF page and in the code check if data already exist in custom setting then don't allow user to update if it is blank then allow user to create record. So its one time process and if some one else access the page they still not able to modify the data.

Answer 3

As long as the code writing the data is in the managed package then yes it can be accessed and updated. The only thing that can see those custom settings is your namespace. Client code and UI cannot see it.

Your POST to the consumer endpoint using their oAuth token will not be able to access it. You will have to tie into something in your managed package code to do this.