1
  1. Created a Connected App and got the Consumer Key and Consumer Secret
  2. Created a RST API Webservice in Salesforce (by exposing Apex Class as a REST WEbservice
  3. Installed 'Advanced REST Client' Plugin in Chrome and followed these steps to generate an Access Token
  4. I am able to get response from POstman as well as Advanced REST Client by using this Access Token (Authorization Type = OAuth 2.0)

Connect App Settings

Connect App Policies

This is how I generated Access token

So far so good..

My question is -

  1. To be able to get the access token I used the Consumer Key + Consumer Secret + username + (password + security token). How would the external application generate the access token? I have given Consumer Key and Consumer Secret to the third party.

  2. How do I ensure third party app is securely and successfully authenticated in Salesforce every time it calls the salesforce webservice, and is able to retrieve the data?

Improve this question

2 Answers 2

Reset to default
2

So if your third party web service does not need to access Salesforce on a "per-user basis" (I.e. retrieve different results based on the user logging in), you could go with the JWT Flow. This is a good use case if you have an "integration user" that is doing the heavy lifting.

If you need "per-user" access and want to not pass the credentials, you may want to look into implementing Web Server Flow authentication. This allows a user to securely login to Salesforce and pass a One-Time code to the third party application which allows it to get a valid access token and possibly a refresh token depending on the scope of your connected application.

Improve this answer
2

If you have used Salesforce Workbench, you don't have to provide API key and API secret to log in. Workbench uses its own API key and Secret to log you in. All you provide is the Username password, but you dont provide them on workbench site, you provide them on Salesforce site. Workbench uses Oauth2 WebserverFlow

Most 3rd Party uses Oauth Webserver flow to get access token and access Salesforce on behalf of the end-user. There isnt a risk of exposing password, and you dont have to manually change password every time it changes on sf in your code.

If you want just a single user you can go with JWT bearer flow.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .