So, I'm in the process of setting server to server communication between SF and Google Cloud. This document OAuth Authorization Flows here lists the available options, and for the heck of it I can't figure out why OAuth 2.0 Username-Password Flow (
grant_type=password) should only be used for 'Special Scenarios' VS OAuth 2.0 Web Server Flow for Web App Integration (
grant_type=authorization_code) or OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration (
Both OAuth 2.0 Web Server Flow for Web App Integration and OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration have a huge drawback in the fact that they need pre-authorization by visiting an URL in the browser and authorize the flow in the SF Web GUI. This step can't be automated, no matter what.
grant_type=password doesn't need any pre-authorization.
The SF document states:
However, we recommend avoiding this flow because it passes credentials back and forth
I don't get why passing
client_secrets around should be less secure than than passing around user and password of a highly restricted service user when the connection is end-to-end encrypted anyways.
Probably some oAUTH experts could chime in and clarify things a bit.