I am creating an external app, where I need to get the data from Salesforce.

I understand the use of Connected apps, and I won't be using the web based OAuth flow where user is redirected to https://login.salesforce.com with some parameters and provides the credentials, then is redirected back to the client app after successful authentication, so consider it a console application (not salesforce console app).

I have the Salesforce credentials, and connected app client id and secret too, but is there any way I don't need to provide salesforce credentials in my console app. I read some documentations, but there they are providing username, password, client id and secret. I was wondering if any reason is there we provide username and password with client id and secret. There are many systems which provide app id and secret so that we don't need to use the account credentials anywhere.

Can anybody help? Or may be any link to documentation where something like this is mentioned?

  • Asking for advice on how to call an api without knowing what operations you will be performing exactly is very vague as a question. can you please update your post with the specifics? – glls Mar 19 '19 at 13:17
  • I wrote in first line, I need to get the data, consider I just need to call a rest API there. – Aditya Vijay Mar 19 '19 at 13:21
  • there are many types of data, for example, public vs private, what about permissions, etc etc... – glls Mar 19 '19 at 13:23
  • The concept of OAuth is that it needs a browser to complete the flow. If you're not using that, you may as well use the SOAP login method, which also requires credentials. There's no way to use OAuth without a web browser context involved. The username+password OAuth flow is not meant for production use, as it is considered insecure. – sfdcfox Mar 19 '19 at 13:24
  • 4
    The OAuth JWT flow can be executed headless (no browser) but it does still require you to perform setup on the Salesforce org and securely store a "credential" (a certificate file), but not a password. – David Reed Mar 19 '19 at 13:50

Expanding on my comment:

The JWT Oauth flow may be what you want, if you're operating a headless back-end application with no user interface. With the JWT flow, you'll create a Connected App in Salesforce and pre-authorize specific Profiles or Permission Sets to connect without any further user-mediated approvals.

The Connected App will be seeded with a certificate, which your application will also hold. You must protect this certificate as a critical secret, because by using it your application will be able - with no user intervention and no password - to authenticate as any user who's assigned one of the pre-authorized Profiles or Permission Sets.

As your authentication parameter, you'll pass a JWT payload signed with this certificate that includes the username you wish to log in under. You won't include - or have! - that user's password or security token.

JWT is often used in continuous integration, so you'll find detailed instructions on setting up the Salesforce side of the flow in the SFDX documentation.

JWT is easy to implement in many languages. Here is an example (my Gist) of adding JWT authentication to simple_salesforce in Python.

| improve this answer | |
  • Okay I read about this (any some more ways) here help.salesforce.com/…, so I need atleast the certificate to accomplish this. I was thinking some other ways of certificates use. I asked the question as many other platform provide other pair of id and secret for integrations, which can be invalidated immediately as well just in case they are compromised, without changing the account user passwords. Didn't get why the question got close requests! – Aditya Vijay Mar 20 '19 at 6:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.