I am in the process of creating a custom SOAP apex web service using webservice keyword so that external system can call this apex web service. I am not using Apex REST.

From the class I can create WSDL and share it with the external system. Apex REST clearly documents that it supports OAuth and Session ID authentication but no documentation for Apex SOAP Web service.

How can I secure this apex SOAP web service ? What authentication mechanism is supported ? How can external system connect to it securely ? Do they have to pass salesforce username/password/token?


You need to pass in a Session ID that has API access. You can get this Session ID any way you want, including SOAP login() (see Setup > Develop > API for the WSDL files), SAML authentication via Single-Sign On (SSO), the Session ID from a Workflow Outbound Message, or any of the OAuth flows (Web Server, Client, or Username-Password). You provide the Session ID through the SessionHeader provided by the WSDL.

You'll want to check the appropriate documentation for your chosen method of logging in. The SOAP login() and the OAuth Username-Password flows require directly handling the username and password, while the other methods handle the login through other means, such as logging in through a WebForm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.