Let's say you have a system that you want to integrate with Salesforce. You create a new user for the system, set up a trusted ip range, make the profile an API-only user, and then give the username and password to the system. If the worst were to happen and the credentials were compromised, it seems like there is a good level of security in place. The attacker wouldn't be able to login to Salesforce through the ui since the credentials are api-only, and they also wouldn't be able to login through the api since they are at a different ip address and their login attempts would be denied with a error message saying that they need a security token.

Are there other precautions involving the login process that should be taken to ensure Salesfore stays secure?

2 Answers 2


I would also recommend 1) setting strict permissions on which objects the API user can access and 2) regularly rotating the API user credentials


@Martin, You can also consider Login Hours. A detailed documentation on setting Login restrictions can be found Here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .