I have an app that lives outside of salesforce on my own servers. I am going to link to it from within a different app that is already in Salesforce. Ideally I don't want the user to have to login again.

Would it be possible to simply pass in the current user's session ID and server URL in the link via query params and re-use those params in my external app to populate my SforceSercive object?


Link within Salesforce would be "https://myCustomApp.com?sessionId={currentUserSessionId}&serverURL={currentServerURL}

Then in my external app, parse those two params and populate my SforceService object like:

var client = new SforceService();    
client.Url = serverURL; //(from URL)    
client.SessionHeaderValue.sessionId = sessionId; //(from URL)

Or is the session ID specific to the domain it was created in?

  • 1
    Sending sessionId in URL seems riskyu Commented Nov 19, 2018 at 20:41

1 Answer 1


In theory, you can. In practice, you should not. The ideal situation would be to use the appropriate API to get your own, separate session. You can use the Canvas API to get a session in a frame inside Salesforce, or you can use the OAuth 2.0 Web Server flow. Both methods can be configured for full, seamless integration, no login required. Keep in mind that if you decide to use the browser session, the Lightning Session ID will not be valid for API use, so you'd still need a separate token if you plan on doing anything useful.

  • Thanks, great response. With regards to the OAuth flow, would each user (or their admin) need to create a Connected App first before being able to use the oAuth flow for my external app? Commented Nov 19, 2018 at 20:43
  • 1
    @MeyerDenney No, the connected app is created in your org, and will be automatically "installed" in any subscribers that use your app (subject to org security settings). Worst case scenario for OAuth flow is that user has to click "Grant Access" on first use.
    – sfdcfox
    Commented Nov 19, 2018 at 20:45
  • 1
    @MeyerDenney Also, read my answer on the difference between the two technologies.
    – sfdcfox
    Commented Nov 19, 2018 at 20:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .