This should be an easy question, but for some reason I have found some difficulty in finding resources that help with our simple use case:

Company A (does not use SalesForce) has data that they wish to send periodically to Company B's Salesforce. Company A will send the data using any format needed to fit Salesforce's data structures. Ideally this would be done via a REST API. Company B has created a connected app on their SF and provided Company A with the consumer key and secret. The problem is that sending data via the rest API using the consumer key and secret also requires an SF username and password for OAuth. Should Company B create a user account for Company A in addition to the consumer and secret for this type of integration to work? I went over the SF REST API docs but wasn't able to clarify. Specifically here:

In your client application, redirect the user to the appropriate Salesforce authorization endpoint. On successful user login, Salesforce calls your redirect URI with an authorization code. You use the authorization code in the next step to get the access token.

In our workflow, the user is not part of the process. Company A will have a backend process that will periodically format the data and send it to Company B.

Thank you.

  • This question is way too broad - what documentation are you refering to? and please do not jus tinclude the link, if there is any part of it you dont seem to grasp, include it in a highlighted paragraph. Please note we are not here to provide advise on how/what you should do since we are unfamiliar with the underlying architecture/design, etc etc... we are mostly here to address specific Salesforce issues you are encountering, make sure you include your code, if applicable. In the meantime, take some time to read How to Ask and take the tour in order to get familiar with the forum. Thanks – glls May 6 '18 at 14:32
  • Thanks @glls. I added more info. To clarify, the question is not around the best way to design this, but how does one actually authenticate with the API, and what should Company B provide to Company A. Thanks. – user64063 May 6 '18 at 14:48

What you have described is a "classic" integration scenario. While this can be achieved either using P2P (point to point) or having an ETL in place while using either SOAP or REST API but for any of the mechanism to be able to interact with data, it does go through two step process:

  1. Authenticate the User (to make sure this is the right user to access the system)
  2. Authorize the User (to allow user access to the appropriate resources after successful authentication)

Now coming to REST APIs, if you see this excerpt from the documentation, it states:

Before making REST API calls, you must authenticate the application user using OAuth 2.0

That signifies that while you can use REST APIs to make calls to access resources, you need to be authenticated first. And for any sort of authentication, you need to have a user credential set for the process (front end user login process or backend user login process) which is authenticating itself in Salesforce.

Why connected app? Because REST APIs authenticate to Salesforce using OAuth 2.0 and that the platform feature to integrate other systems to Salesforce using APIs is facilitated through connected apps.

A connected app integrates an application with Salesforce using APIs. Connected apps use standard SAML and OAuth protocols to authenticate, provide single sign-on, and provide tokens for use with Salesforce APIs. In addition to standard OAuth capabilities, connected apps allow Salesforce admins to set various security policies and have explicit control over who can use the corresponding apps.

If you see this, the process of being able to access a connected app is what is typically the authentication flow and that's where a user credential is required. Once authenticated, it then provides the token to be able to be used by the caller for further requests. And that the level of access is determined within the connected app and the profile with which the user is set up.

Summing this up, in your use case scenario:

  1. Company B needs to setup a user for Company A - which usually we call as Integration User with the necessary profile permissions. This profile typically is setup with the API user permission.
  2. Company B needs to create a connected app (because you are choosing to integrate using REST API) and provide the client secret and key to Company A
  3. Company A needs to authenticate to Salesforce using the user credentials, the client secret and key
  4. Company A then uses the authorized access token received after authentication for further requests
  • Glad that it helped you understand this. I have had trouble understanding this topic overall when I had first started getting into details :) – Jayant Das May 6 '18 at 17:00
  • Why not use jwt oauth flow if it's server to server integration? – RedDevil May 7 '18 at 6:43
  • @RedDevil yes, there are definitely ways to achieve this. However in this case it more looks to be data integration which could be either p2p, using on premise/cloud etl, etc. and this approach solves most of the use cases. – Jayant Das May 7 '18 at 9:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.