We have developed a portal accessed by users who use our product - a desktop application. In addition to what our desktop app does, it needs to make API calls directly to Salesforce, authenticated as the user. This means we want our desktop app to be able to accept salesforce credentials for our user and the desktop app will make an auth call against SF, fetch the token and then use that for subsequent API calls to Salesforce.

The problem is that the initial auth call requires not only a username and password but also a security token and for various reasons we dont want the users to have to enter that security token into the Desktop app directly.

We have a mechanism by which an Apex page launches our app and passes in some key information about the user who is launching the app and the best thing would be to be able to pass the security token of the logged in user at that point. Then the App could use the security token if an API Auth call needs to be made, along with the user's entered credentials.

The problem is that I dont see any way to access the users security token via apex code. So there is no way to pass this token to the desktop app when launching it? An additional problem is that we are using IP whitelisting which means even if we wanted our users cannot retreive the security token themselves (even if they wanted to).

All of the above tells me that there must be some other approach that would allow us to get our desktop app to authenticate against salesforce?

Any ideas and suggestions would be appreciated? Or clarity as to what I am missing!


1 Answer 1


Depending on how long you need the application to be able to communicate with Salesforce for, you should be able to get the current session id by calling UserInfo.getSessionId() from your Visualforce controller and passing it into your desktop application.

Your desktop application will never need to call the login endpoint, or touch your users' credentials, but it will not be able to refresh the token should it expire.

EDIT: This works well for quick integrations, but if your desktop app has a UI and is dependent on users doing clicking about and doing user stuff, it might not be the best idea.

  • Thanks. Your idea is good and we are already doing that...in other words initially we pass the sessionid directly to the App and all API calls use that. However we need a fall back for when the session expires while the user is using our app - which they can use for a while before "calling home". The fallback is for the user to re-authenticate and thats what I am trying to figure out. So sounds like from what you know there is no way to retrieve the user's token via apex?
    – Gotts
    Mar 27, 2017 at 17:43
  • Not that I'm aware of sorry, if you need a reliable, refresh-able connection, I'd (perhaps unhelpfully) recommend asking them to log in again to the desktop app so you don't have to store/pass credentials anywhere; it's not ideal from a user's perspective, but should minimize any security risks.
    – AndySis
    Mar 28, 2017 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .