I am an ISVforce developer and I am trying to create a managed package for the AppExchange. Our app will make API requests to our external API. Our API requires an authentication token that we generate. I am trying to figure out the best way to authenticate on our end.

I'm leaning away from using OAuth because I don't want our salesforce customers to deal with setting up an Auth Provider to use our app. Ideally a client (salesforce admin) would install the package and it just works for all their users.

I've been following the official ISVforce Guide and came across the following recommendation:

"We recommend designing your external service to use the user ID and session ID to authenticate and identify users."

source: https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/packaging_external_services.htm

I have been searching for the best way to authenticate in this manner (or maybe I'm barking up the wrong tree). I found out in Apex we have access to both the user id and the session id via the UserInfo class.

I think the following flow could work for my situation:

  1. Send user id and session id using an un-authenticated request to our API.

  2. On our end authenticate and identify the user like the above quote say.

  3. Our API generates and returns our authentication token.

  4. Client receives our authentication token and can now make authenticated calls to our API.

I am stuck on step 2. How would we validate a salesforce user id and session id from our external resource like the guide suggests? Is this possible?

1 Answer 1


Authenticating and identifying a Salesforce user by their User ID and SessionID is a fairly common practice for Canvas Apps Signed Requests and old school composite apps that passed the Session ID on the query string to an iframe.

Along with the Session ID I'd also pass the Server URL. With those details I can make an API call back to Salesforce to something like getUserInfo() or the REST API equivalent.

Once you have the user info Salesforce you can cross check it with the user id they claim to have. If everything checks out you can then find the equivalent user in your system and provide the authentication details back. I use a combination of the Org ID and User Id provided from the Salesforce API call to map to local users. You need both to handle Sandboxes where the User ID will be the same as the prod org it was created from.

You should must validate that the Server URL is indeed one of the valid Salesforce APIs to prevent someone faking the Salesforce services. Beyond that, this provides a robust way of checking with Salesforce that they are who they claim they are.

  • Thank you very much! This is precisely what I was looking for.
    – tpdietz
    Jul 5, 2017 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .