I'm writing a simple nodejs application that signs in to the api with a username, password and security token, obtains an access token which is used to make api calls.

Basically, the app is ready for production and they don't want to pay for a new username and password login for the app.

Is there any way one of their existing admin users can create a different form of static credentials for the app to login with?

1 Answer 1


If you use OAuth to log in, your access would be considered "static" in the sense that the changing the username or password would not automatically revoke access to the application. This is how most apps work. Note that whomever logs in would need to remain an active user, however. This is the main reason why integration users are used, so that access is not dependent on a specific "normal" user. You can choose to use an existing administrator, but also keep in mind that anything that the app does (e.g. modifying records) will appear to have been done by the administrator.

  • My app is different from most in that, it will always be accessing one specific (my orgs) salesforce account. All users of my app will be putting data into the same table. Hence why username and password login is ideal. As I understand it, the purpose of OAuth is to allow users of my app to provide credentials which is not what I want. I want a set of login credentials, the app can use to get an access token without any user interaction. Is this possible? Sorry if I misunderstood.
    – rosghub
    Commented Nov 4, 2019 at 22:43
  • @rosghub That might not be what you want, but neither would a username/password setup. Maybe you might want to create a Guest account (via a Community or Site) and then provide unauthenticated access? In Salesforce, there's really no such thing as a "username and password that does not have an associated user."
    – sfdcfox
    Commented Nov 4, 2019 at 23:03
  • OK that makes more sense. So it seems like my options are, either continue using username and password to perform actions on behalf of a user (which is also fine), or have an admin provide unauthenticated access to a guest account, which would basically be the same?
    – rosghub
    Commented Nov 4, 2019 at 23:07
  • @rosghub Yes, pretty much the same thing.
    – sfdcfox
    Commented Nov 4, 2019 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .