How to authenticate REST API without going through login page?

Question

I would like to allow end-users that do not have access to Salesforce directly to be able to make orders (a custom object) by submitting a form from a web page.

I would have thought making a simple request to the REST API would allow me to achieve this. Authentication, however, is proving to be a little tricky in this case since we are dealing with non-Salesforce end-users .

I saw that this question is asking something similar but I think in this case one would still have to log in at least once which would not work since the end-user will not be able to with no credentials.

I am following the instructions for authenticating the REST API on this link (https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_web_server_oauth_flow.htm) and trying it for a Sandbox Environment.

My question is - I was wondering if it would be possible to get the authorization code and automate the login step instead of having to manually login every time?

This way, the end-users would not be faced with the login page and the authentication happens automatically.

In short, I would like to know if step 2 from the attached link can be automated or skipped.

Thanks!

Answer 1

I saw that this question is asking something similar but I think in this case one would still have to log in at least once which would not work since the end-user will not be able to with no credentials.

The User here being mentioned is not the End User. It will be typically an Admin User from your Web application who would need to perform that step at the very beginning to get a refresh token. Before any integration you will need to make sure that the connections between systems are set so that they can communicate between themselves. This step is necessarily about the pre-requisite before integration can work. Once you get a refresh token, instead of Username/password authentication everytime, the flow uses refresh token for further authentication and thus it should be protected.

In short, I would like to know if step 2 from the attached link can be automated or skipped.

No. As mentioned above, this step is the pre-requisite to setup the integration process.

My question is - I was wondering if it would be possible to get the authorization code and automate the login step instead of having to manually login every time?

Yes. That's how the Web Server OAuth Authentication Flow fits in authentication flow. The initial flow is utilized to get a refresh token and that is later used automatically to get a new access token based on if the token is expired or active. Take a look at How Does the OAuth Refresh Token Fit Into the Authentication Flow? which has more details as how a refresh token is utilized after the initial basic setup to get the access token for every subsequent requests.

Answer 2

The APIs require running in the context of a user, which typically requires being authenticated first. However, one can create a custom, "public" anonymous SOAP or REST Apex Service and then have it hosted in a Community or Site with the Guest User profile granting access to it. That'll allow anyone to call the API so you'll want your own security built into it. All the orders will be created using the "Guest User".

Along those lines, you could also create a public, anonymous Order Form using Visualforce or Lightning to create the necessary data. Ensure the "Guest User" profile has the necessary permissions and that you create the necessary security too. All the orders will be created using the "Guest User".