For every API I'm consuming from Salesforce so far, I'm using the Client Credentials Grant for everything that's just between servers (= no user involved). It seems that Salesforce itself does not support the Client Credentials Grant at all. If so, why? And is my assumption even correct? What would be an alternative - and why?


All transactions in Salesforce are user-based. User access determines field level and record level access, page layouts, and so on. There's absolutely no way to perform an action as an anonymous "non-user." Even automated processes use an "Automated User" user for logging actions against. This is related to the auditing capabilities of Salesforce. The typical alternative is to log in as an admin or integration user.

  • You do have a point there. Still I'm wondering why Salesforce is having an "Automated User" while there's no way for us to do so - without wasting a license for a dedicated user that is. I mean - it does make sense since Salesforce is so user centric but then again - why having something that you won't give to your users? On the other hand - that wouldn't be the first feature that is only available to Salesforce and not to its users. Thanks for the clarification.
    – Semmel
    Mar 11 '19 at 9:46

It's correct that you cannot perform a Client Credentials grant, but headless authentication, scoped to a user, is pretty easy. You can accomplish this with the OAuth 2.0 JWT Bearer Token Flow

Simplified steps...

  1. Create a Connected App
  2. Generate an X509 Cert and upload the cert to the Connected App
  3. Set the connected app policy to Admin approved users are pre-authorized
  4. Give one or more of your users access to the app via Permission Sets or Profiles.
  5. Make sure your external application has access to the X509 private key. Take care to store this securely with your application.
  6. Generate a JWT using the user you'd like to authenticate with. You'll set their username to the sub property. You'll sign it with the X509 private key.
  7. Post it to the token endpoint with grant_type equal to urn:ietf:params:oauth:grant-type:jwt-bearer

This will return you an access token. Find a library in your preferred language to help with the construction and signing of your JWT. More details in the link above.

  • 2
    This adds a lot of useful information. Thanks!
    – Semmel
    May 2 '19 at 19:42
  • 1
    This is one of the things that really baffles me - we seem to have tons of ways to connect to Salesforce but if I want to consume another API from Salesforce I find myself writing code from scratch.
    – Semmel
    May 2 '19 at 19:46
  • 1
    Regarding "Find a library in your preferred language to help with the construction and signing of your JWT." -> jwt.io lists tons of libraries per tech stack. Sep 20 '19 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.