0

I'm writing a simple nodejs application that signs in to the api with a username, password and security token, obtains an access token which is used to make api calls.

Basically, the app is ready for production and they don't want to pay for a new username and password login for the app.

Is there any way one of their existing admin users can create a different form of static credentials for the app to login with?

0

If you use OAuth to log in, your access would be considered "static" in the sense that the changing the username or password would not automatically revoke access to the application. This is how most apps work. Note that whomever logs in would need to remain an active user, however. This is the main reason why integration users are used, so that access is not dependent on a specific "normal" user. You can choose to use an existing administrator, but also keep in mind that anything that the app does (e.g. modifying records) will appear to have been done by the administrator.

| improve this answer | |
  • My app is different from most in that, it will always be accessing one specific (my orgs) salesforce account. All users of my app will be putting data into the same table. Hence why username and password login is ideal. As I understand it, the purpose of OAuth is to allow users of my app to provide credentials which is not what I want. I want a set of login credentials, the app can use to get an access token without any user interaction. Is this possible? Sorry if I misunderstood. – rosghub Nov 4 '19 at 22:43
  • @rosghub That might not be what you want, but neither would a username/password setup. Maybe you might want to create a Guest account (via a Community or Site) and then provide unauthenticated access? In Salesforce, there's really no such thing as a "username and password that does not have an associated user." – sfdcfox Nov 4 '19 at 23:03
  • OK that makes more sense. So it seems like my options are, either continue using username and password to perform actions on behalf of a user (which is also fine), or have an admin provide unauthenticated access to a guest account, which would basically be the same? – rosghub Nov 4 '19 at 23:07
  • @rosghub Yes, pretty much the same thing. – sfdcfox Nov 4 '19 at 23:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.