We've have created plenty of REST Apex classes and access them using OAuth 2.0 using Web Server Flow (consumer secret, consumer key, etc.)
However, we're in the process of creating our first REST Apex class that a 3rd party partner will have access to.
Since our current APEX REST classes are used by our own client applications (hosted on our servers), we feel they're secured.
My question is what is considered best practice to allow a 3rd party partner to use a new APEX REST class? This class will return back one opportunity record (JSON)
My thinking is to continue to use OAuth 2.0 and do the followng
- Create new Connected App
- Selected OAuth Scopes
- Add IP Restriction?
- Provide partner consumer secret/key
Is this sufficient or is their a better secured way?
Also, is there a way to use OAuth without having to give the partner a Salesforce user account? It would be ideal to just be able give the partner an endpoint to retrieve an access token and then use our Salesforce REST Apex passing the access token.