Third party lead generation service scope access for creating new leads

Question

Background: We're a lead generation service. We sell the leads (as a subscription) to multiple customers. Many of our customers use Salesforce. I'm trying to create an app that will create/push new leads to our customer's salesforce instances. Our app should have a scope something like:

• Write access for new Lead objects
• Read access for activity on only the Lead objects we created (optional)
• Update access on only the Lead objects we created (optional)

What method should I be using to sync our data with our customer Salesforce instances? I think my best options are:

1. Connected App using the REST api
   Scope seems very liberal. api,id,refresh_token gives me full read/write access to all of their leads. This will certainly work, however our customers probably don't want us to have access to all their account data. I don't see a way to tighten down the scope.

2. Salesforce Connect aka Lightning Connect
   I have little understanding on how this would work, and their docs seem pretty unclear. However, this seems like our application would have a more appropriate scope.

---

FWIW, I've built an connected app oauth2 proof of concept using jsforce (not sure if this helps explain my question above)

let jsforce = require('jsforce');
let express = require('express');
let app = express();

app.listen(3000, () => console.log('app started'));

let oauth2 = new jsforce.OAuth2({
    clientId: '...',
    clientSecret: '...',
    redirectUri: 'https://example.com/callback'
});

// Redirect to salesforce
app.get('/auth', function (req, res) {
    res.redirect(oauth2.getAuthorizationUrl());
});

// Get access token for user from salesforce
app.get('/callback', function (req, res) {

    let conn = new jsforce.Connection({ oauth2 });
    let code = req.param('code');
    conn.authorize(code, function(err, userInfo) {
        if (err) { return console.error(err); }

        // TODO: save accessToken, refreshToken, instanceUrl somewhere
        res.send('Cool beans.')
    });
});

Answer 1

TL/TR: You want to use a Connected App.

Lightning Connect:

Lightning Connect reaches out to external data in ODATA (2.0 / 4.0) format. No data is pulled into Salesforce, but is kept in the external system. From what you describe you want to hand off your data.

Connected App & scope

The scope is only liberal at first look. The documentation says: api Allows access to the current, logged-in user’s account using APIs, such as REST API and Bulk API.

So what you do is to request an integration user account (platform permission should do, not a full user) who has limited access to the whole system.

Considerations

• You might want to offer to push to a custom object e.g. "LeadSubscription" and leave it to the customer to transfer them to leads - they might have their own ideas on lead assignment, reporting etc. (Mostly works for large accounts)
• For "security concerned" user (or licence constraint ones): Don't store the session token, so no "background push" would be possible
• Offer a sample application that can be deployed in Heroku that allows to pull from your API and push to Salesforce (easy to build e.g. using NodeRED - disclaimer: I maintain the Salesforce nodes).
• Have a AppStore app customers can deploy that talks to your API or UI for interactive import of leads

Hope that helps