I am trying to do simple integration using outbound message. However, I would love to be able to add authorization headers to the SOAP message as the requirement is that we use Oauth2 to authenticate the message. I have searched for solutions and it seems like my only option, if I want to continue to use outbound messages, is to create a proxy that sits infront of the listener.

Does anyone have any experience with this workaround? What are some pros and cons of using this solutions? And if anyone is kind enough to point me to right resources on how I might build this proxy on something like node.js that would be much appreciated!

If anyone has a suggestion for a better or simpler solution that uses Outbound Messages let me know too.

Also I should mention I've used StackExchange a lot but I am a new contributor. So if there are some specific format or best practices I'd also appreciate the feedback. Thanks!

  • 1
    Is outbound messages a need? can't that be done using Platform events? Nov 2, 2018 at 16:43
  • @PranayJaiswal I hadn't though of that. I think this could be a possibility, however, i'm not sure platform events are as robust as outbound messages when it comes to retrying if an ack was not received. But i may be wrong... i'll definitely look into it. Thanks !
    – George
    Nov 3, 2018 at 14:31
  • Platform events are more robust,u can even replay old events. Which just makes life so easier Nov 3, 2018 at 14:32

1 Answer 1


You are very limited with authentication options from Outbound Messages. If you really need authentication headers on the outbound request you are going to need an intermediate service to add them. This was somewhat covered in HTTP Basic Authentication for Workflow Outbound Messages.

I've prototyped it in the past, but you could even go so far as having a Salesforce public site fill the intermediate role - Workflow Outbound Message to Salesforce Web Service.

Both of those options add an overhead to the whole process. One more potential point of failure.

I've found the easiest way to authenticate outbound messaging is to include the session id in the request.

The receiving web service then uses that session id and server url to call back into Salesforce partner API. You need to confirm that the server url is for a domain that Salesforce controls. Then the Salesforce API will confirm that the Session is valid. Additional checks can be made with the details available via the API. For instance, I confirm that the OrgID is one I'm prepared to communicate with.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .