I want to develop a front-end in Javascript (possibly with one of the fancy frameworks around such as AngularJS) that consumes the REST API of my Salesforce org.

I don't want to embed my project in Salesforce technologies, so basically

  • no Visualforce pages
  • no Force.com Sites

I do want to write my own front-end on a separate server that just makes AJAX calls to the Salesforce back-end.

In addition, I want the application to be accessible for any user, even if he/she does not have a Salesforce account. So the AJAX calls should not require that the user logs in on Salesforce. I want anonymous users to be able to retrieve public data from my organization and create new entries when it is useful (in the case of a survey for instance).

Even though these requirements generate some security concerns, I can imagine that Salesforce takes care about the requests rate limits on their API endpoints and that it is possible to restrict the access to the API on a host name base (e.g., only requests with origin host my-trusted-domain.com should be allowed, send a 403-Forbidden otherwise). I would be surprised if SF does not provide such basic features.

How would you proceed? Is there a minimal Javascript code that works out-of-the-box on any domain without getting into troubles with CORS?

  • The only way to access the Force.com REST API without authenticating is to expose your Apex endpoints through a Force.com site. Why do you not want to use sites? Commented Jan 19, 2015 at 14:13
  • Just to make sure we are on the same page, I don't want users to authenticate. However I don't see any problem in authenticating my application (through a token-based authentication mechanism for instance).
    – Buddyshot
    Commented Jan 19, 2015 at 15:08
  • 1
    Salesforce is rolling out CORS in the Spring '15 release. I'm publishing a blog post on the subject this week, so I'll write a more comprehensive reply linking to that in a day or two.
    – metadaddy
    Commented Jan 19, 2015 at 16:47

2 Answers 2


From the Spring '15 release (coming soon), you will be able to use (most of) the Force.com REST API from JavaScript served from outside Salesforce. Spring ’15 Preview – CORS for the Force.com REST API shows how to upload to Chatter Files, for example.

As that article mentions, there are a few areas that are not currently accessible:

  1. Apex REST Methods (/services/apexrest endpoints) - your own web services running on Force.com
  2. Describe Global (/sobjects API endpoint) - a listing of your org's objects and their metadata
  3. Query (/query API endpoint) - the ability to run a SOQL query via API

2 and 3 were a known issue, but were resolved before the Spring '15 release.

If you need Apex REST Methods, you'll need to run a proxy. The Force.com JavaScript REST Toolkit facilitates this, as described in Calling the REST API from JavaScript… from Anywhere!


Every transaction in Salesforce is based on User context. For this reason, no matter how you approach it, you will always need an Authenticated user to perform an action. There are a couple of exceptions:

  1. Email-to-Case/Web-to-Lead - for each of these, data is originating from an unauthenticated form or email. Within Salesforce you must identify a user for each of these transactions to run as.
  2. Force.com Sites - every unauthenticated transaction runs as a guest user.

So in order for you to achieve what you want to do, you must identify a user for every transaction OR you exploit the above two examples to achieve what you want to do.

Basically what I am saying is that what you want to achieve is impossible. Salesforce makes it impossible because they make money off the number of users you have. The moment you build an application without a User context, they are giving away their shared architecture for free.

  • Interesting. Then what if I create a User in SF that will be used to perform all the transactions from my remote application? Is it what happens when we use what they call "Connected Apps"? It looks like the app itself is registered on the OAuth2 provider of Salesforce from what I've read.
    – Buddyshot
    Commented Jan 19, 2015 at 15:33
  • @Buddyshot Yes, having a dedicated user will work. You will need to be registered as a Connected App so that you can use the login flow to authenticate the application. I assume the only difference is that your app will be providing the credentials instead of the user. I imagine because this is a javascript app that it will be difficult to securely use the login flow, but my javascript knowledge isn't very vast. Commented Jan 19, 2015 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .