6

I'm trying to create a webshop, containing the products from our salesforce community. I'm not able to figure out how to get access to this data, without the user having to log in first. Which is really not an option.

Also, the thought is to have the user going through some steps with choosing products and accessories, and from there create a user programmatically, and then create a sale in salesforce with the products to this newly created user.

I have been able to fetch all this data, but with having to log in first.

But mainly, the issue is getting the products (custom sobject) on the frontpage.

It's a wordpress-solution, and we're using jquery ajax to call API. Is there a way to do this?

Improve this question

1 Answer 1

Reset to default
6

You'll want to read all about setting up a public REST API. Basically, you create a @RestResource, then enable the class for the Public Site Settings, and then you can call them without being logged in. Note that any functionality you put in this endpoint can be used by anyone, besides people using your site, so make sure that you limit what can be done with the API.

Alternatively, you might consider setting up a synchronization cycle with your WP database on a periodic basis. You can then query your own MySQL server instead of trying to hit the public REST API. This has the advantage of making sure that your products are always available, even if Salesforce is under maintenance.

A third option could be to set up a limited profile/user and have the site use OAuth or some other technique to log in to this user. Yes, you'll have to burn a license, but you'll have a bit more security, since you're not directly exposing the REST API to the public Internet without some sort of authentication.

Other solutions are also possible, but these tips should get you started.

Improve this answer
2
  • If I want the public rest api to create a user with data from my form-fields, would that be safe? Or do you know how I could do this safely? Thanks
    – Marius W
    Commented Mar 12, 2018 at 10:14
  • 1
    @MariusW As long as the security details are fixed (e.g. it will always be a limited permission profile), then that should probably be okay. I would probably add some sort of anti-spam feature just to make sure that a bot doesn't fill up your database with fake users, but other than that, it shouldn't be too bad.
    – sfdcfox ♦
    Commented Mar 12, 2018 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .