We have implemented Federated SSO for all our users with our Identity management and got stuck with few API users who interact with salesforce with API only, how can we exclude certain users from SSO and use default login. As far i have read the details only Delegated SSO lets me exclude users and for Federated SSO i dont have option to exclude specific users (Its either all or none). Can anyone tell their experiences or best practices for API users in Federated SSO

3 Answers 3


1.Make sure your API users does not have Federated Id populated .In other terms leave that as blank .

2.In My domain make sure , Prevent login from https://login.salesforce.com option is unchecked so users can use login.salesforce.com to login .

  • but wouldnt that let any user in the org to login through login.salesforce, i am hoping i can only let API users use the login.salesforce and rest enforce they come in only through SSO. Its creating a security if i let users login using login.salesforce.com. Any way i can restrict for all users but not few? Commented Sep 20, 2017 at 4:27
  • Try with step 1 only and making federated I'd blank and use login.salesforc.com to log as admin .My assumption is that should allow admin to log in . Commented Sep 20, 2017 at 5:08
  • Also how about for those users make them API only users via there profile .I think to make them API only users you will need to close the profile and an API only users cannot use Salesforce UI Commented Sep 20, 2017 at 5:19

Thanks for comments and inputs, figured out finally! Below setting in SSO only prevents user logins through UI and our API logins remains unaffected, i.e even after enforcing 'Prevent login from test.salesforce' we are still able to make API calls to that end point, i believe this setting is not applicable to API calls and we able to use salesforce username password for the oAuth flow for the connected app. So i believe its safe to say that 'UI logins' are SSO enforced by Federated SSO but API logins can still be used with salesforce credentials.

Hope salesforce can mention this in any documentation of help text next time for others not to get confused

enter image description here

  • The help text next to the Login Policy checkbox reads: This applies to every login except SOAP API. So if you're using the REST API I suspect this will not work. Commented Oct 15, 2018 at 17:44

My understanding is that public domain restrictions apply for both browser AND API.

However, federated SSO can be made mandatory on a profile-base

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .