I am working on a web application where we are syncing our system generated leads with SalesForce. When a user comes to leads screen in our web application we show them a button to log into SalesForce (SF). We are using OAuth and Rest Apis to ask users to login to SF. When the user clicks the button (on my leads page) user is directed to SF to get authenticated. SF in return sends us a token which we use to communicate/sync our data with SF. Everything is working perfectly fine, however there is one problem.

I dont want the users to log in everytime they have to sync data. Is there a way for users to log in to SF from my web application only once and I can remember the users settings (just like 4 square I only provided my FB and twitter account information only once and now 4square remembers me).

I did try a solution where I asked for users SF user id, password and his secruty token and I saved that in my database locally and using web services provided my SF logged in automatically and able to sync data seeminglessly.

I am not sure if storing users' SF account details is the right things to do (industry standard) and I know that its going to be little tricky for users to get hold of their security token.

What is the industry standard of seeminglessly pulling and pushing data to and from SF without asking users to get authenticate.


1 Answer 1


Use OAuth flow to obtain a refresh token. You can then store this refresh token without compromising the user's credentials. This would be the recommended approach. See oauth refresh token for info.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .