Calling Apex REST class from post install script

Question

I need to call an exposed Apex class in my dev org from the post install script. This post install script will run on the installation of the managed package on a clients org and will send the package version, org id of the client org and company name to the Apex class by making a REST call. The Apex class will save this info in a custom object.

@RestResource(urlMapping='/MyAPI')

global with sharing class LicenseManager {

    @HttpPost
    global static void recordPackageInstall(String orgId, String packageVersion, String cmpName) {
         //my code
    }
}

In my post install script I plan to call it like this

HttpRequest req = new HttpRequest();
HttpResponse res = new HttpResponse();
Http http = new Http();

req.setEndpoint('https://na14.salesforce.com/services/apexrest/MyAPI');
req.setMethod('POST');
req.setBody('{"orgId":"1234", "packageVersion":"2.3", "cmpName":"My Client"}');
res = http.send(req);

How do I create a authorization token? I am following this link : http://www.salesforce.com/us/developer/docs/api_rest/index_Left.htm#StartTopic=Content/quickstart.htm

and it tells me to create a connected app in my instance salesforce org and use the generate key as authorization token. But I am confused on how it is to be used.

Do I use the consumer key? Do I use the consumer secret? How do I use it?

I tried something like this:

req.setHeader('Authorization', 'OAuth ' + accessToken);

where String accessToken = 'consumer key';

But it gives me Status = Unauthorized and code 401.

What am I doing wrong?

Answer 1

I'm not even sure this is possible with OAuth. If I were you, I would expose the Apex REST Method for unauthenticated access (see Quick Tip – Public RESTful Web Services on Force.com Sites), and pass some shared secret in an HTTP header. You can put the shared secret in a custom setting in the managed package, so it's not accessible to the customer), and test for it in the REST method in your dev org.