Best authentication flow to use for Rest API without interacting or login to salesforce application?

Question

We have web application that need to read & write data to Salesforce. For that, Web application have to authenticate with Salesforce and get access token.

I refer all authentication flow mentioned at Salesforce community. As per the Web application requirement, in our case, there would be no user interaction that login to salesforce application and allow to access. We have already implemented the Username-Password flow but it would require "Security Token" and in some cases due to security concerns some of the customers wouldn't able to generate(in case of SSO) or deny to share it. Additionally, Salesforce doesn't support Username-Password flow method.

So please suggest the alternative suitable authentication flow that authorize the request and receive access_token.

Answer 1

For non-interactive applications (e.g. a server connecting to Salesforce), you should look at using the JWT Bearer flow.

Be aware that as part of setting up that flow, you'll need to manually go through another flow (one that generates a refresh token, such as the web-server flow) for each org you want to use the connected app in.