I have built a REST API client to a third party application and I am exposing the VF page to everyone in my org without having them to login to my salesforce application.

I need to maintain a session information of 3rd party application (not salesforce) so that I can use that session ID in my next API call. How do I do that?

Below is an illustration :

Request 1 : invoke a request to third party application API and get session ID Request 2 : Use the session ID and do update in the 3rd party application.

note : I dont want to send session information in response rather I want apex to cache it, use it in my subsequent requests.

1 Answer 1


This does not sound secure, to be honest. Can't you use established mechanisms of authentication such as OAuth?

If you need to store authentication tokens I would use a custom setting.

  • Considering this in only force.com page and I am not sending 3rd party app session back to the browser. I believe it is still safer. Also, there are different team that will be using this utility and they wouldn't have an account in Salesforce just to upload files which will anyways to go 3rd party app and will not be stored in Salesforce. Jan 25, 2018 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .