I am new to salesforce and I am writing an integration to an external REST web service and wondering about where the best place would be to store custom configuration details such as the url and login credentials. These credentials should be editable and hopefully package-able for deployment in customer instances.

Right now I'm not sure if we'll go with just a javascript button or APEX code so something that would be available to both would be ideal.

1 Answer 1


If you are packaging the information the best place would be to store the information in a private custom setting (Reccomended as a best practice for managed packages to store sensitive information.

Keep in mind that you cannot create an encrypted field in a custom setting.

If you are not going to package then you can use an object that has encrypted fields to store the data. (Keep in mind that a profile with the right access can see the information.

Also, if you are packaging (with security review) you cannot store passwords anywhere. you will have to use oAuth and store the refresh token.

General goto document on oAuth:


Basically the flow from inside salesforce would be to:

  1. Create a VF page to fire off the oAuth Process using the logged in users current sessionID and a scope that returns a refresh token
  2. Once the user allows the refresh token will with included in the url parameters
  3. Store the refresh token.
  4. Whenever your app needs to log in as the user, using the refresh token and the refresh token oAuth flow, request a new session ID.

There is more to each individual item above and it is meant as a high level overview. But this process will allow you to, once a user allows access, log in as the user ay time your application requires it.

  • Awesome. Good info. How would the oAuth work? I'm roughly familiar with oAuth in general, but I'm wondering about how it would be applied in this case to "store the refresh token"? Commented Aug 25, 2014 at 22:32
  • @user3143122 Updated the answer to respond to your comments
    – Eric
    Commented Aug 25, 2014 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .