We are building a Mobile App (using React Native) which will allow users (of Persona-A) to login via External Identity Provider. We have another set of users (Persona-B) who login to Salesforce Custom LEX App.

Requirement: We need to establish integration between Mobile App and Salesforce, so that Persona-A users can send/transfer the data to Salesforce which Persona-B users can review & confirm. We have created Custom Apex REST Services in Salesforce which will be used by Mobile App to send data. Persona-A will never login to Salesforce.

**Solution:**We are thinking of 2 approaches to implement this: Approach.1: Create a Secure API Only User in Salesforce and use this user account to transfer data from Mobile App to Salesforce. Only way we could do this is by creating a Connected App, establishing an OAuth connection by storing the credentials of this API user in the Mobile App config file.

Approach.2: Create a Public Site in Salesforce and expose the APEX REST services through this site. Once user login to Mobile App (after authentication with ExtIdP), when they send data to Salesforce, we trigger the REST callout to Salesforce Public Site. To make sure that Public Site is receiving request from valid source, Mobile App will send the "OAuth Token" and "Username" in every REST Callouts, and Salesforce Apex REST class will authenticate the request this agains the ExtIdp, before proceeding with further processing.

Here are my questions:

  1. In Approach.1, is this approach is in violation of Master Subscription Agreement or against License Compliance?
  2. In Approach.2, is there any way to connect with Salesforce via Secure API Only User without using the OAuth Username-Password Flow?
  3. Any particular concept I should be aware of about the Approach.2?

closed as too broad by glls, Pranay Jaiswal, Himanshu, Sebastian Kessel, battery.cord Apr 5 at 13:23

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Approach 1 - that is something that is supported by Salesforce and its apps look on Heroku Connect it uses single user to sync data with Salesforce.

I strongly recommend to put some backend in the middle that will proxy and bulkify all requests to Salesforce in order to avoid hitting Inbound API limits and have ability to manage all requests to Salesforce going from Person A apps

Approach 1 schematics

  • Thanks for your suggestion. – wesfaith Apr 4 at 16:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.