we're using a Session ID (retrieved via the following command) to access a few of our Salesforce APIs from external sources.

curl https://login.salesforce.com/services/oauth2/token -d "grant_type=password" -d "client_id=myclientid" -d "client_secret=myclientsecret" -d "username=mylogin@salesforce.com" -d "password=mypassword123456"

However, on every release, this is invalidated and it takes a lot of work to reset and update. Is there a better/easier way to handle this?

  • What is the context? Are you attempting to establish a persistent connect from some external web server? Who does it authenticate as? – David Reed Feb 10 '20 at 17:32
  • @DavidReed we have a job on an external web server that hits a Salesforce endpoint ~every 10 mins to pick up new records to process. It's authenticating as a User created specifically for this task – McD Feb 10 '20 at 17:50

I would recommend using the JWT flow for this use case, not the username-password flow.

There is a nice guide to doing headless JWT authentication in the Salesforce DX Developer Guide. You don't have to use SFDX to do this; there are JWT libraries available for many languages.

The benefit of using JWT is that your application can always obtain a new token (and in fact, always must be prepared to do so, since you don't get a refresh token), and is always ready to do so in a headless fashion - no user intervention required past initial setup.

Since you can assign a Permission Set to your integration user and preauthorize that Permission Set on your Connected App, you can tightly scope the availability of this authorization pathway and make sure your org stays secure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.