I have recently been introducing some online forms and interfaces with Salesforce. They are all working well which I am very happy to report!!!

My question is, at the moment I am using my own user, password and token to authenticate. Naturally when I am required to change my username/password the API communication will break. Is there best practice as to how I enable this, do I create a new user as an "API User" with a profile with minimal access (Create records only) and no password restrictions?

  • 3
    Look into using OAuth instead of using a users information to do a login in the future. – battery.cord Jul 22 '16 at 16:04
  • 1
    @battery.cord You are correct, although comments are not intended for answers. I suggest you post this comment as an answer (perhaps adding a bit more information). – sfdcfox Jul 22 '16 at 18:36

If you have a spare license, you can set up a new user as you've specified. While it does cost money, because licenses are not free, it does prevent things like expiring your query cursors while you're still using them, possible security breaches, etc. Basically, you just need to create a new profile, then create a new user.

Create A Profile

Go to Setup > Manage Users > Profiles, create a new profile, cloning from Read Only, then save it. Once saved, go to the Object permissions, add create permissions for any objects you want. Also, review the Field Level Security for those objects to make sure they can access/edit all the fields they need to; if a field is read-only, they can't insert a value on creation for that field. Next, add the API Only User attribute to the profile to prevent GUI logins, and the Password Never Expires attribute to prevent a need to change passwords.

Create A User

Go to Setup > Manage Users > Users, create a new user, giving them the new profile you've created, and choose not to send a new password immediately. Make sure all the other details are filled out as needed.

Set A Password

Call the setPassword API to specify a new password of your choice. I personally do this through a Custom Link (Setup > Customize > Users).


var newPassword = prompt("Please enter password");
if(confirm("You're about to set a new password for user...")) {
    var result = sforce.connection.setPassword("{!User.Id}", newPassword);
    if(result) alert(result.faultcode);

Just add the custom link to the User layout, then go to the new user you've created, click the link, and follow the directions. If you don't get an alert, you've set the new password successfully. You can use this new password immediately for the new user.

  • Thanks, Glad I wasn't doing something incredibly wrong but we did purchase a few spare licenses expecting this sort of thing. It saves my username being associated with all the records too :D. – sfdc_beginner1 Jul 23 '16 at 10:11
  • @sfdc_beginner1 Yeah, I'm pretty sure almost every org over about 100 licenses or so purchase at least one license intended to be used for integrations. We have 2 or 3 ourselves, to integrate with our various legacy systems. It saves a lot of hassle. – sfdcfox Jul 23 '16 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.