Which OAuth 2.0 Flow Should I Use?

Question

I have an Web App that need to get access to Salesforce Data. The web app just needs one admin to connect and afterwards needs to be able to interact with the Salesforce APIs to push and pull data.

The app will have scheduled CRON Jobs for inserting, updating, and reading Salesforce data. Thus, I obviously do not want somebody to have to login everysingle time.

The perfect world is that the admin of the SFDC org logs in onetime into our Web Apps Admin Panel and then the Web App has connectivity from that point on.

I am looking into the OAuth Authorization Code Flow. But not entirely sure if this is the best approach.

I have also been looking at the OAuth 2.0 JWT Bearer Flow. It is specifically designed for server-to-server integrations, which seems like a better fit for our needs. Although, the setup seems more complicated.

Answer 1

You most likely want the Web Server Flow. This flow provides a refresh token that your application can use to obtain access tokens without user action beyond the initial authorization flow.

The JWT Bearer Flow is suitable for fully headless solutions. If you're building a web application that each customer individually authorizes in the web UI, Web Server is what you want, not JWT.