Is there a simpler way of accessing my companies data through the REST API, and have the web server that fetches that data be indefinitely authenticated?

I tried using the web server flow with a refresh token but after a while when the sessions expires, the webserver fails to fetch data as its being redirected to the salesforce login page.

The current setup using the login + password flow works as it has the credentials to login, however i am looking for a safer option without exposing our credentials.

My company uses Salesforce to store customer accounts, and orders, which are later displayed on our Wordpress website. When the user logs in on Wordpress their email is used as a key to query Salesforce for their orders. Steps are:

  1. User logs in on wordpress at www.company.com
  2. www.company.com queries api.company.com with the users email and checks if they have made any orders.
  3. If the token is valid get data, if expired refresh it with a refresh token.

The problem mentioned is when the session expires and api.company.com is asked to log back into salesforce.

  • What is the profile being used for Oauth increase the session time for that profile if company security permits – Avijit Chakraborty Jun 20 '17 at 0:23
  • Is there a way of setting the session time to indefinite? I saw there is an option under session settings whether to log out the user after a token expiry which i have unchecked but it still logs out. – Zoran Ilievski Jun 20 '17 at 1:03
  • For server to server, you need to use the Username-Password OAuth Authentication Flow – Kaon Z Jun 20 '17 at 3:28
  • You may want to look into setting up a connected app and using the web server flow with refresh token. Also you need to be requesting offline access during the auth to get a proper refresh token, – Eric Jun 20 '17 at 4:57
  • @KaonZ That is what im realising. I will need to look into storing the credentials safely. – Zoran Ilievski Jun 21 '17 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.