My use case is similar to Web-to-Lead: we collect user data, then add it to salesforce as new lead. I would like to upgrade to the API for higher reliability and fine-grained control.
I believe I can simply write an Apex class and expose it via REST. The hard question is authentication. I don't fit the standard OAuth case -- this is server to server communication, and I don't want a user to have to log in. Nor do I feel like the hassle of creating a callback URI listener in my web application.
I have a web server which sits at a static IP, and that is the only IP that needs to do this. You would think this could be used in some way.
At the moment, the best I'm coming up with is:
- Create an "API only" user (which costs a bit, but OK), and
- Ensure my static IPs are listed as trusted in salesforce, so that I don't need a user security token
- Send a SOAP login request as the API user, and get the session ID
- Call my APEX class, using the session ID as authorization
- Logout (optional?)
This is not the most efficient flow as I have to do the last 3 steps for each request.