4

We created an appexchange application that runs on Heroku. This application can run without the user loging-in each time. For this we use the Remote access app with consumer key and consumer secret. Now the issue is that an administrator need to setup this remote access application and het needs to paste the consumer key and secret in our application to properly work.

I would like to eliminate that step so our application can query through apex for the consumer key and secret, is this Possible?

I want in fact the same approach like Chatter desktop uses, but i can't find any documentation about this topic.

Thanks for your help!

Improve this question
  • 1
    Why does an admin need to handle the remote access credentials? A remote access app defined in one org can be used by users in any number of other orgs without creating any consumer keys/secrets. – metadaddy Sep 18 '12 at 13:38
3

No - it's not possible to retrieve a remote access app's consumer key/secret via Apex.

The approach Chatter Desktop uses is the OAuth 2.0 'user agent' flow - the Chatter Desktop carries a consumer key, but no secret, since an attacker could just read it out of the app's binary.

Improve this answer
  • Thx for the answer metadaddy we will investigate this further out. the document is quite clear thx – Sven Delporte Sep 18 '12 at 19:10
  • User agent flow is indeed the solution for our problem. We use the client id(consumer key) in our code and we don't use the secret – Sven Delporte Sep 24 '12 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.