I am working on an AppExchange App, which needs to integrate with a 3rd party system. The 3rd party system is having basic authentication and not having Oauth authentication method. With this authentication method, username and password will be passed in Hashed format.

My AppExchange app is not storing any username and password in Salesforce.

Is Calling a Basic Authentication (hashed) API from AppExchange APP recommended as per Salesforce Security standards? As I don't have any control on 3rd party 's authentication, will use of Basic Authentication (hashed format) fail my AppExchange 's security review?

Please guide if you have suggestions for the same.


1 Answer 1


Using basic auth should not fail your security review unless you hardcode your token in Apex. Also consider if end customer should have access to this token. If no you can use private Custom Metadata to store it

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .