Can my app auto-update an installee's security settings to allow them access to my API?

Question

I work at a company that sells data about private companies. We have an API and our customers sign up to get an API key, with which they can make API calls to get data about specific companies.

More recently, we decided to develop a Salesforce app (using VisualForce and Apex classes) that would allow Salesforce users to be able to search our data while they are logged into Salesforce. I created a developer account and spent 2 months creating the app.

Regarding my developer account, there were some settings that I set manually, using the web interface. For instance, before my developer account could make API calls to my company, I had to whitelist the URL of our API.

Now I am trying to turn this app into an app that can be released in the Salesforce App Exchange. I found this page here about creating an Install script that can automate some of the setup of our app:

https://help.salesforce.com/articleView?id=apex_post_install_script_intro.htm&type=0

However, I have not been able to find anything about the interface needed to set security settings. Can I adjust a company's security settings from the install script? Can I add the URL of our API to their whitelist?

Answer 1

The ideal way for you to package your settings is inside a "Permission Set". That way the end user has the freedom to add the permission set to as many (or as few) users as they prefer.

While you could do the same in a "Profile", that means you will force your user to choose between their existing profile and yours.... Permission Sets are preferred here since you can add them to users, regardless of their profile (well, not quite "regardless", but almost).

PS: You can (and should) also package "Remote Site Settings" if your app will make an API Call.... that's the whitelist you mentioned