1

We are currently integrating with a payment provider wherein we send some request and get some response.

The payment provider then does a callback and posts the status after some time for the request that was sent to my global Rest API where its gets authenticated and gets processed further.

We have developed it as a managed product and packaged it. The Apex Rest API class is exposed through public site which should be configured in Subscriber org.

Now we want to work out this whole product for customers which uses Professional edition. We don't have sites in PE orgs. What is the work around? I can think of having a external app which takes a request and then sends data to Salesforce.

Improve this question

1 Answer 1

Reset to default
0

As you say, a Professional Edition org can't host a public site, so it has no capacity to expose you Apex based REST API for an unauthenticated callback from the payment provider.

Some possible options:

  1. Have the payment provider call the Apex REST API directly by providing a valid access_token in the header.
  2. Have the payment provider raise a platform event in Salesforce. Again, this requires authentication to Salesforce.
  3. As you say, create some external middleware to bridge the functionality into Salesforce.

How secure does this need to be? You mention payment processing, so I assume you want it secure. There is a risk with using a public site that others could discover it and start calling it with mock responses from the payment provider. Just something to think about.

Improve this answer
1
  • 1
    Yes, you are correct regarding security. The requested string is encrypted and is taken care by out API.
    – Anshul Agrawal
    Commented Dec 17, 2018 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .