I'm writing an application that needs to connect and grab some data from Salesforce. Data will be pulled by a background script (no UI) and then populated in a web UI.

I can't find anything explaining how authentication can be achieved in this specific scenario when I don't have any login/pass flow, meaning the oauth2 grant_type=password is totally inadequate in this case.

Since my script will work in background, a grant_type=client_credentials could work, an API key as well ...

Can someone please point me in the right direction?


  • 1
    Just to clarify, why is the OAuth 2.0 Username-Password Flow not going to work? It won't require any user interaction. You just need a way to securely store the Salesforce credentials on the server. – Daniel Ballinger Jul 25 '16 at 20:06
  • Thx your for replying Daniel. AFAIK in OAuth2 the "password" grant type is supposed to engage the user in entering their credentials and authorizing the app to use their data. This is meant specifically to avoid storing user credentials server-side, so using other grant types like "client_credentials" is more appropriate for server-to-server comm where you don't need any user involved in the process. And most examples in the doc (which is dense and very misleading for a new person to SF) show screenshots of that authorize dialog box, which is specific to the resource owner grant (password). – Hatem Jul 26 '16 at 15:19

From the OAuth 2.0 Username-Password Flow docs:

The username-password authentication flow can be used to authenticate when the consumer already has the user’s credentials.

This OAuth authentication flow involves passing the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token will be issued.

In this case your background application is the consumer. As long as you can securely store an API users Salesforce credentials within the application then you can use this follow. There will be no UI interaction to enter the credentials.

I say "API user" as you would typically put aside a single Salesforce user for this task. They get a profile that grants them access to just the records required via the API. You would also set their password policy to not expire.

| improve this answer | |

I would rather use the OAuth 2.0 JWT Bearer Token Flow.

The only prerequisite is to have on both servers the same certificate for:

  • at your server side, sign the request using the private key of the certificate
  • salesforces to verify that you are the one who signed the request.

They give a code sample to sign the request.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.