Are Multiple API Users Required to Restrict Access to Specific REST Endpoints? Can we limit based on Connected App info?

Question

Based on this question: Securing a REST API and this one How to limit an access to specific REST endpoint? it seems that the only way I can limit access to specific custom endpoints is to create multiple API users. Currently we only have one API user for our connected application, but we were hoping to make the process more secure by restricting access to certain APIs depending on which connected 'app' was connecting. We created multiple Connected Apps in Salesforce to be dedicated to specific functions, but all requests actually originate from the same app (just different areas within the app).

The above linked questions are 2 years old, so I am curious if this answer still holds true. Do I really need to create multiple API users if I want to restrict access to specific custom REST endpoints? Or can I somehow limit a specific connected app to only have access to a specific subset of endpoints? Seems kind of unfair to make us waste valuable user licenses just to make our APIs more segmented, no?

If the answer still holds true, is it possible to add additional security to my endpoints by somehow checking programmatically to see what connected app initiated the request, and kick back an error message if it didn't originate from the correct connected app (client key/secret combo)

Answer 1

Due to security reasons salesforce has not provides us access to the table showing which User got which session using which connected app. Which I belive is failry straight forward from salesforce to stop people misusing other people's session ID.

Can you do a workaround for the same? Well Yes you can.

Create an object/custom setting Having two following fields.

APIKey|AppName.

Now modify your rest request to in such a way that you send the API key as a parameter in your request body.

Now in your apex class Query the table and check the APIkey is same in app and in your request.

   {
  "body": {},//Your rest Body
  "api-key": "YourAPIKey"
}

Your Apex class will look something like:

@RestResource(urlMapping='/CUSTOM_DATA/*')  
global with sharing class MY_CUSTOM_DATA{
   global static void myMethod(){
      //Query the table
    //Parse the body to see if the API key matches the request

     //Do your JOB
    }
}

Make sure you only share specific API key with the integrating partners they want to connect with.

Its a bad architecture to share same user password with multiple integrating partners.