5

So what I read everywhere is that, in order to connect to Salesforce via the API, you'll have to authenticate using OAuth.

But this involves creating a Connected App, which is 'cumbersome' for normal users. They just want to login and go.

How do e.g. Jitterbit and Mavensmate etc solve this? I don't install Jitterbit/Mavensmate in my org, do I? There's no connected app in my org. Yet, they can access my data when I provide my username and password+token.

How can I connect to Salesforce without running via OAuth and a Connected App or installing something in the org?

Improve this question
7
  • In the SF docs it says that "Partners, who wish to get an OAuth consumer Id for authentication, can contact Salesforce". Would that imply that Salesforce would be able to give me a Salesforce-wide Consumer ID + Secret?
    – Willem Mulder
    Jan 15, 2015 at 16:19
  • I see that a SOAP connection does not work with OAuth, which might be the answer I'm looking for...?
    – Willem Mulder
    Jan 15, 2015 at 16:29
  • See salesforce.stackexchange.com/a/56344/67 - there's no need for your users to each create a connected app. You do that once, as the developer. That's how Jitterbit etc do it.
    – metadaddy
    Jan 22, 2015 at 18:27
  • 1
    In general, yes! Admins can install your app, and configure policy, or configure policy once users have started using your app in that org, or even disallow unconfigured apps, but, in any case, you, as the developer, define a connected app exactly once.
    – metadaddy
    Jan 26, 2015 at 1:55
  • 1
    As I said: in general, yes. The default is that, at the moment of creation, a connected app defined in dev org A will work in production orgs B or C, without any intervention. From Spring '15, the admin can configure API Client Whitelisting, in which case, "All client applications that are not configured as connected apps are denied access". In that case, the admin will need to use the connected app's Install URL to whitelist it.
    – metadaddy
    Jan 26, 2015 at 16:26

1 Answer 1

Reset to default
6

You can use any login call, and you'll be able to use that session ID with REST. This probably isn't clearly documented, but there are similar questions on here (and other forums) that do explain this.

For example, I use this code to get my browser session:

document.cookie.match(/sid=(.+?);/)[1]

...which I can then throw directly into the Authorization header (Bearer SID). I use this method when I'm testing our code in POSTMAN (custom REST calls).

You can also use any valid SOAP session, etc. Note that if you do use OAuth, the "scope" of that token must include API access, or it will be blocked.

Improve this answer
6
  • Right. I checked the JSForce source (which is what Mavensmate uses under the hood) and yes, I see that e.g. JSForce uses a SOAP login call to obtain a SessionID and then work with that for the REST calls. Thanks!
    – Willem Mulder
    Jan 16, 2015 at 8:38
  • What is that regex filtering out exactly? The salesforce sid cookie ends with ;?
    – Javier García Manzano
    Jul 27, 2018 at 15:30
  • @JavierGarcíaManzano It's a trick I use in my browser instead of actually parsing the document.cookie string, which is a semi-colon separated list of key=value pairs. Specifically, I'm finding the sid cookie in the list of cookies saved by salesforce. Then, I use that cookie in Postman, or JavaScript, or whatever else I want to do with it. Primarily, I use it as a technique to quickly test API calls when I'm answering questions on SFSE.
    – sfdcfox
    Jul 27, 2018 at 15:33
  • It's pretty nifty for sure! But how do you know it's in that specific position? Is there some way of doing an "order by"? I was checking out my cookies and I have a huge lot between sandboxes and others but in no specific order.... prntscr.com/kbt860
    – Javier García Manzano
    Jul 27, 2018 at 15:43
  • 1
    @JavierGarcíaManzano Cookies are exposed per-domain. When you're logged in to an org, sid will always be your session Id while your org is open.
    – sfdcfox
    Jul 27, 2018 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .