We have managed package, We do sync of data from external system onto a custom object created via managed package.

While syncing we noticed that we need that particular org's Username, Password, Security token in order to make API call. Needing a password is something we would want to avoid from org's . Is there any was to make API calls without needing password? Are we doing something wrong ?

  • 1
    What is initiating the sync process? Is it the external system that is calling into Salesforce? Or is the process initiated from Salesforce? If you start from Salesforce you can access the current users Session ID. May 7, 2018 at 9:08
  • external system is initiating sync process. We are syncing data from external system onto Salesforce custom object. May 7, 2018 at 9:15

1 Answer 1


There are two main options I can think of if you don't want to store the Username and Password in the external system.

  1. Store the Refresh Token for a connected app
  2. Use the JWT Bearer Token Flow for a connected app

Neither flow requires storing (or even accessing) the users credentials and both can request a new access_token as required.

  • Thanks Daniel . I am not sure i completely follow. In our case we want to do server to server sync of data. So how will this work . So as initialisation we step, we will have to get oauth flow done to get token? May 7, 2018 at 10:07
  • @AshishGaonker Correct, with a refresh token you would need some initial user intervention. Once you have the refresh token it would be hands off. The JWT token follow should not require any user intervention. May 7, 2018 at 10:13
  • We are already using one connected app for doing SSO from Salesforce to External system . This connected app is part of package. Can same connected app be used for sysicng using JWT (I could not find way to update certs etc) . Or will I need to create another connected app for syncing data (and that too into package? ) May 8, 2018 at 6:30
  • 1
    @AshishGaonker I'd expect to be able to use the existing connected app. It would need to be modified from the dev packaging org. May 9, 2018 at 21:05
  • Thanks . Ok .. once updated we can repackage and use it to sync data in installed orgs, is that correct? May 10, 2018 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .