How to incorporate Consumer id and consumer secret in my REST API (Apex class)

Question

I have a requirement where some external web forms would be calling our REST API to submit Lead. I have created a connected app, got the consumer id and consumer secret. I want my apex class to be accessible only to those people who have the consumer key and consumer secret. In other words, the lead should only be created if the incoming request has consumer key and consumer secret.

This is my code right now:

@RestResource(urlMapping='/api/createLead')

global with sharing class RESTAPI_JSONPayload 
{


@HttpPost
global static void doPost() {
  RestRequest req = RestContext.request;
  Blob body = req.requestBody;
  String requestString = body.toString();
  String ContentType = RestContext.request.headers.get('Content-Type') ;
//Now as you have the request string You can parse it in APEX

  JSON2Apex rw = (JSON2Apex)JSON.deserialize(requestString,JSON2Apex.class);
  .......
  .......
  ........

Right now, I have been testing it with POSTMAN tool in 2 steps:

Making a POST request first with username, password, client_id, client_secret, grant_type to receive access token.

Then I make another POST request in POSTMAN to create a lead in Salesforce, using the access token I received before and the body.

Questions:

I wonder since I have not incorporated consumer key and consumer secret in my code above, how does that REST class got connected to my "Connected app" in Salesforce and the specific Consumer key and secret coming from the connected app?

Secondly, do I need to provide port number and callback url in my code above? Or whatever I have is fine?

Answer 1

I wonder since I have not incorporated consumer key and consumer secret in my code above, how does that REST class got connected to my "Connected app" in Salesforce and the specific Consumer key and secret coming from the connected app?

You need a valid "access token" to be able to access your API resources. And that you got this by authenticating and authorizing your connected app by using the combination of your consumer key/secret, username, etc. The API is not aware how you retrieved the "access token". So as long as you have one, you will be always be able to access your API.

Secondly, do I need to provide port number and callback url in my code above? Or whatever I have is fine?

The Callback URL is utilized in a Connected App to be able for Salesforce to send the access token to a particular location.

Depending on which OAuth flow you use, this is typically the URL that a user’s browser is redirected to after successful authentication. As this URL is used for some OAuth flows to pass an access token, the URL must use secure HTTP (HTTPS) or a custom URI scheme.

Answer 2

The rest Class that you have created is for the business logic that needs to happen. Typically what happens when external vendors needs to invoke a rest service in salesforce is that, we create connected app in salesforce and based on the oAuth flow we choose we need to provide one of username/password/certificate along with client id/client secret to the vendor to invoke salesforce.

Only if this authentication passes you rest code will get invoked.

I wonder since I have not incorporated consumer key and consumer secret in my code above, how does that REST class got connected to my "Connected app" in Salesforce and the specific Consumer key and secret coming from the connected app?

You dont need to since the first step to access your rest resource is authorization using one of the oAuth flows for your connected App,Post which your target system gets a token which they use to access the rest resource, so no one other than the target system can get access to this rest resource(apex class)

Secondly, do I need to provide port number and callback url in my code above? Or whatever I have is fine?

You dont have to provide port number,based on the oAuth flow you choose you need to provide salesforce URL which the external vendor will use to get the token.

You should read about different oAuth flows to understand how they work and choose the most suitable one after discussion with your vendor