Background: We're a lead generation service. We sell the leads (as a subscription) to multiple customers. Many of our customers use Salesforce. I'm trying to create an app that will create/push new leads to our customer's salesforce instances. Our app should have a scope something like:

  • Write access for new Lead objects
  • Read access for activity on only the Lead objects we created (optional)
  • Update access on only the Lead objects we created (optional)

What method should I be using to sync our data with our customer Salesforce instances? I think my best options are:

  1. Connected App using the REST api
    Scope seems very liberal. api,id,refresh_token gives me full read/write access to all of their leads. This will certainly work, however our customers probably don't want us to have access to all their account data. I don't see a way to tighten down the scope.

  2. Salesforce Connect aka Lightning Connect
    I have little understanding on how this would work, and their docs seem pretty unclear. However, this seems like our application would have a more appropriate scope.

FWIW, I've built an connected app oauth2 proof of concept using jsforce (not sure if this helps explain my question above)

let jsforce = require('jsforce');
let express = require('express');
let app = express();

app.listen(3000, () => console.log('app started'));

let oauth2 = new jsforce.OAuth2({
    clientId: '...',
    clientSecret: '...',
    redirectUri: 'https://example.com/callback'

// Redirect to salesforce
app.get('/auth', function (req, res) {

// Get access token for user from salesforce
app.get('/callback', function (req, res) {

    let conn = new jsforce.Connection({ oauth2 });
    let code = req.param('code');
    conn.authorize(code, function(err, userInfo) {
        if (err) { return console.error(err); }

        // TODO: save accessToken, refreshToken, instanceUrl somewhere
        res.send('Cool beans.')

1 Answer 1


TL/TR: You want to use a Connected App.

Lightning Connect:

Lightning Connect reaches out to external data in ODATA (2.0 / 4.0) format. No data is pulled into Salesforce, but is kept in the external system. From what you describe you want to hand off your data.

Connected App & scope

The scope is only liberal at first look. The documentation says: api Allows access to the current, logged-in user’s account using APIs, such as REST API and Bulk API.

So what you do is to request an integration user account (platform permission should do, not a full user) who has limited access to the whole system.


  • You might want to offer to push to a custom object e.g. "LeadSubscription" and leave it to the customer to transfer them to leads - they might have their own ideas on lead assignment, reporting etc. (Mostly works for large accounts)
  • For "security concerned" user (or licence constraint ones): Don't store the session token, so no "background push" would be possible
  • Offer a sample application that can be deployed in Heroku that allows to pull from your API and push to Salesforce (easy to build e.g. using NodeRED - disclaimer: I maintain the Salesforce nodes).
  • Have a AppStore app customers can deploy that talks to your API or UI for interactive import of leads

Hope that helps

  • Thanks. This is helpful. I wouldn't be opposed to keeping the data in our system. That might even be preferred depending upon how it's implemented. i.e. does external data co-mingle w/ saleforce lead objects? Can saleforce users log activity (calls, emails, notes) on external lead data? If so, can we (the external data source) see that activity? Mar 6, 2018 at 17:22
  • Also, if we go with a connected app, is there a way to request/create an integration user w/ proper permissions on oauth connect? Ideally the integration would be super simple for our customers, so they don't have to muck around with security settings. Mar 6, 2018 at 17:23
  • Glad you like it. Feel free to accept the answer ;-) External data doesn't "co-mingle". What you would do: Provide an OData 4.0 API for your leads and a custom Object e.g. SCLead. In a screen your customers would Pick, Choose and Assign those leads to their sales channel... effectively copying them into Salesforce standard objects. You can package all this into a Salesforce APP your customers can import from our Appexchange
    – stwissel
    Mar 7, 2018 at 1:31
  • Accepted. Can you comment on my second comment re: connect app, and oauth automatically (for our end user) creating an integration user with proper security? Mar 7, 2018 at 12:21
  • Creating a user and a matching profile (which defines the security access) is a common activity in Salesforce administration. Shouldn’t be a big deal for your customers. You can actually sign up for a free Developer instance of Salesforce and try everything out
    – stwissel
    Mar 8, 2018 at 5:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .