I am trying to authenticate to Salesforce from 3rd party service (custom java app). Users in the 3rd party app should be able to search records in salesforce (query rest api call) and create new records. However they should not authenticate to Salesforce every time they open the app (web server oAuth flow wouldn't be very user friendly). Ideally user in the 3rd party app shouldn't even know records are coming from Salesforce.

  • All users of 3rd party app can also access salesforce and vice versa
  • Both apps authenticate users with 3rd party iDP

Theoretically the best candidate here would be JWT bearer flow https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5 However that flow, if I understand it correctly, will give access to salesforce records with permissions of user defined in the managed app.

How can I possibly run salesforce's rest api query as a given user as opposed to that integration user from the connected app? I want to respect sharing hierarchy in salesforce while making these queries

1 Answer 1


You must authenticate to Salesforce as the user whose permissions and visibility you wish to apply.

Bear in mind the the Web Server flow provides you with a refresh token, so you don’t need to have the user log in every time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .