Our salesforce org needs to expose some functionality as a REST API class to an external app. We created the apex class(@RestResource(urlMapping='')), now to provide access to the external app :

  • We created a new Integration User with limited access to profile and API enabled = true.
  • We provided the credentials of this user to external app.
  • We created a connected app and provided client_id and secret to external app.
  • We provide salesforce oauth URLs to external app.
  • External app uses Username Password oauth authentication flow with salesforce using these details to get access token.

We would like to explore a way without having need to create an Integration user and sharing this user's credentials.

How can this be achieved?

  • 1
    Are you proposing to expose your REST service with no authentication at all, i.e., to the public Internet? Or are you looking for an authentication solution that does not require credentials?
    – David Reed
    Jul 29, 2019 at 11:50
  • we are looking for authentication solution that does not require credentials. We would prefer if we do not need to set up a user in salesforce for integration.
    – Walker
    Jul 29, 2019 at 11:53

1 Answer 1


"Authentication without credentials" is fairly close to being a misnomer. By definition, if you want to authenticate a caller, you need some kind of credentials, and the best and most secure solution is to use a Salesforce user authenticated via OAuth.

There is another option that is suitable for specific situations, but is not a general-purpose replacement for credential-based authentication: a webhook. Webhooks are exposed to the open world and manually authenticate that inbound messages come from some client that knows a pre-shared secret. They do this by validating an HMAC signature (loosely, a cryptographically secure hash of the message content plus some pre-shared secret).

The webhook's Apex class is exposed to the world as an unauthenticated REST service on a Force.com Site.

Webhooks thus provide message integrity checks and a species of authentication without sharing user credentials. However, they come with some significant limitations.

  • If there's more than one caller using the same pre-shared secret, you can't tell them apart, and there's no audit trail of what client made what request.
  • You have to write more code to achieve the authentication on both the sending and the receiving end.
  • It is easy to make mistakes in crypto code that reduce or destroy the security of your solution.
  • Your receiving user will be the Site Guest User, under whose context the Apex class runs. This imposes a lot of permissions-based limitations on what you can do, and may conflict with other things you hope to run on that Site.

In most situations, I would encourage using an integration user.

An integration user should always authenticate via OAuth and store a refresh token (unless using the JWT flow, in which case it should store a username and certificate). The remote system should not store a username and password. However, authentication to Salesforce always requires that a user exist in the target system.

  • Using an integration user would also mean sharing its credentials. Someone raised some questions over that. Is it possible to authenticate without having need to share salesforce integration user's credentials ?
    – Walker
    Jul 30, 2019 at 8:17
  • 1
    @Walker Integration users don't have to be shared across connections. You can use one for multiple integrations, or one for each. You also don't have to actually transmit the credentials. The remote system should authenticate using OAuth.
    – David Reed
    Jul 30, 2019 at 11:30
  • Will the remote system be able to authenticate with salesforce using oauth without needing integratino user credentials and only connected app client id and secret ? We dont need any manual intervention since salesforce REST API will be called by external application through code.
    – Walker
    Jul 30, 2019 at 14:14
  • 1
    No. You always have to have a user if you want to authenticate to Salesforce. What you should not do is store a username and password. See my edit above.
    – David Reed
    Jul 30, 2019 at 14:17
  • 2
    @Walker Client Id and Client Secret are not credentials. They identify your application. I want to be clear here: you cannot authenticate into Salesforce without a user account. Full stop. You can choose an OAuth flow appropriate to your situation, but a user account will always be involved.
    – David Reed
    Jul 30, 2019 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .