In a managed package performing calls to external API what is best way to support multi-tenancy?

Let's say I have a hosted multi-tenant API that accepts incoming request such as api.hosted.com/tenant-id/some-resource (or you can imagine that tenant-id is coming within request params). I also have a managed package deployed to the different Salesforce organizations calling this API in particular situations.

Organization Id - Tenant Id is a one-to-one relationship - what is best way to estabilish it? How can I make so that particular installation of package know what tenant it relates to?

Option I am using know is just letting know every customer particular secret that he inters via package configuration screen that allows me to establish association. However I want to get rid of manual steps.

Ideal way would be to parameterize managed package installation link with such secret - but as far as I know there is no such possibility

1 Answer 1


What about using the Org Id itself? You have access to it via your Subscribers tab in the LMA application, as well as it's accessible by your code via UserInfo.getOrganizationId(). It would anyway arise some security concerns if not used together with another secret/password, since one can guess another's Org Id (they're sequential as any other Id). Maybe you dropped this option for this reason?

  • 1
    As an alternative solution anyway you could use your own "Org Id encryption" method, which you and only you knows in its transformation logic. That way you keep the org Id <-> secret key relation straightforward, but the security concern about anyone trying to guess your secret key is mitigated.
    – MLucci
    Nov 11, 2014 at 21:39
  • Great answer - thank you! I will accept it. However in order to have LMA as I understand package should go through security review and/or be listed in AppExchange. This is not our case yet - can you think about other options just for regular managed packages. Nov 12, 2014 at 12:28
  • I'm sorry I'm not aware completely of how it works for free managed packages... Guess somehow you should be aware of your App subscribers, but could be that given the non-commercial relation between you and the subscriber then no information gets disclosed. This is worth another question for somebody to reply maybe? :) Glad to be helpful!
    – MLucci
    Nov 12, 2014 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .