4

We created an appexchange application that runs on Heroku. This application can run without the user loging-in each time. For this we use the Remote access app with consumer key and consumer secret. Now the issue is that an administrator need to setup this remote access application and het needs to paste the consumer key and secret in our application to properly work.

I would like to eliminate that step so our application can query through apex for the consumer key and secret, is this Possible?

I want in fact the same approach like Chatter desktop uses, but i can't find any documentation about this topic.

Thanks for your help!

1
  • 1
    Why does an admin need to handle the remote access credentials? A remote access app defined in one org can be used by users in any number of other orgs without creating any consumer keys/secrets.
    – metadaddy
    Sep 18, 2012 at 13:38

1 Answer 1

3

No - it's not possible to retrieve a remote access app's consumer key/secret via Apex.

The approach Chatter Desktop uses is the OAuth 2.0 'user agent' flow - the Chatter Desktop carries a consumer key, but no secret, since an attacker could just read it out of the app's binary.

2
  • Thx for the answer metadaddy we will investigate this further out. the document is quite clear thx Sep 18, 2012 at 19:10
  • User agent flow is indeed the solution for our problem. We use the client id(consumer key) in our code and we don't use the secret Sep 24, 2012 at 13:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .