I'm running in a issue where the user password and token get reset every 30 days and I will need to update the code whenever password reset happens.

What is the best practice here ? Create an individual user solely for API usage ? or use one of the existing user's password ?

(I tried not to uncheck the force reset password option)


The best practice depends on your use case. If this is interactive, switching to OAuth may be a better fit. If this is for an integration, I would recommend a dedicated integration user for the following reasons:

  1. If the user account is shared with a person, your sessions could conflict and cause each to be logged out.
  2. If the API-only user is being used only from integration servers, the profile can be locked down additionally by IP and/or business hours, depending on the application
  3. You can define a better password policy for the integration user
  4. A shared account could be disabled if/when the user leaves the company, causing your app to be locked out

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.