I'm writing a python application which shows some metrics about an organization. However, I'm running into two problems:

  1. There are no service accounts - I need to fetch information from Salesforce without acting as a specific user. With Google API there is the concept of a service account which has access to any resource + can be delegate any identity.
  2. OAuth authentication flow requires user redirection - I run my app on an EC2 container and all the fetching are done in the background, I can't have users having to sign-in using their Salesforce account any time they access the service. I would like to have a token of an administrator/service account in another way besides the redirection method. I came across this question & answer but I couldn't figure out how to use it in my application.
  • 1
    Setting aside my answer for a moment, have you considered using a Salesforce Site?
    – Derek F
    Commented Jul 10, 2018 at 13:07

1 Answer 1


I believe the JWT Bearer OAuth 2.0 flow is the way to go here.

There is some setup involved (you need to generate/use an X509 certificate, use the user-agent or web-server flows to authorize once), but after you do that the JWT flow can run in a headless environment (such as AWS).

I went into some pretty fine detail in authentication using jwt about how to use the JWT flow (the example is in Apex, but should be commented thoroughly enough to make a python implementation pretty easy).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .