5

So what I read everywhere is that, in order to connect to Salesforce via the API, you'll have to authenticate using OAuth.

But this involves creating a Connected App, which is 'cumbersome' for normal users. They just want to login and go.

How do e.g. Jitterbit and Mavensmate etc solve this? I don't install Jitterbit/Mavensmate in my org, do I? There's no connected app in my org. Yet, they can access my data when I provide my username and password+token.

How can I connect to Salesforce without running via OAuth and a Connected App or installing something in the org?

  • In the SF docs it says that "Partners, who wish to get an OAuth consumer Id for authentication, can contact Salesforce". Would that imply that Salesforce would be able to give me a Salesforce-wide Consumer ID + Secret? – Willem Mulder Jan 15 '15 at 16:19
  • I see that a SOAP connection does not work with OAuth, which might be the answer I'm looking for...? – Willem Mulder Jan 15 '15 at 16:29
  • See salesforce.stackexchange.com/a/56344/67 - there's no need for your users to each create a connected app. You do that once, as the developer. That's how Jitterbit etc do it. – metadaddy Jan 22 '15 at 18:27
  • 1
    In general, yes! Admins can install your app, and configure policy, or configure policy once users have started using your app in that org, or even disallow unconfigured apps, but, in any case, you, as the developer, define a connected app exactly once. – metadaddy Jan 26 '15 at 1:55
  • 1
    As I said: in general, yes. The default is that, at the moment of creation, a connected app defined in dev org A will work in production orgs B or C, without any intervention. From Spring '15, the admin can configure API Client Whitelisting, in which case, "All client applications that are not configured as connected apps are denied access". In that case, the admin will need to use the connected app's Install URL to whitelist it. – metadaddy Jan 26 '15 at 16:26
6

You can use any login call, and you'll be able to use that session ID with REST. This probably isn't clearly documented, but there are similar questions on here (and other forums) that do explain this.

For example, I use this code to get my browser session:

document.cookie.match(/sid=(.+?);/)[1]

...which I can then throw directly into the Authorization header (Bearer SID). I use this method when I'm testing our code in POSTMAN (custom REST calls).

You can also use any valid SOAP session, etc. Note that if you do use OAuth, the "scope" of that token must include API access, or it will be blocked.

  • Right. I checked the JSForce source (which is what Mavensmate uses under the hood) and yes, I see that e.g. JSForce uses a SOAP login call to obtain a SessionID and then work with that for the REST calls. Thanks! – Willem Mulder Jan 16 '15 at 8:38
  • What is that regex filtering out exactly? The salesforce sid cookie ends with ;? – Javier García Manzano Jul 27 '18 at 15:30
  • @JavierGarcíaManzano It's a trick I use in my browser instead of actually parsing the document.cookie string, which is a semi-colon separated list of key=value pairs. Specifically, I'm finding the sid cookie in the list of cookies saved by salesforce. Then, I use that cookie in Postman, or JavaScript, or whatever else I want to do with it. Primarily, I use it as a technique to quickly test API calls when I'm answering questions on SFSE. – sfdcfox Jul 27 '18 at 15:33
  • It's pretty nifty for sure! But how do you know it's in that specific position? Is there some way of doing an "order by"? I was checking out my cookies and I have a huge lot between sandboxes and others but in no specific order.... prntscr.com/kbt860 – Javier García Manzano Jul 27 '18 at 15:43
  • 1
    @JavierGarcíaManzano Cookies are exposed per-domain. When you're logged in to an org, sid will always be your session Id while your org is open. – sfdcfox Jul 27 '18 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.