Let's say you have a system that you want to integrate with Salesforce. You create a new user for the system, set up a trusted ip range, make the profile an API-only user, and then give the username and password to the system. If the worst were to happen and the credentials were compromised, it seems like there is a good level of security in place. The attacker wouldn't be able to login to Salesforce through the ui since the credentials are api-only, and they also wouldn't be able to login through the api since they are at a different ip address and their login attempts would be denied with a error message saying that they need a security token.

Are there other precautions involving the login process that should be taken to ensure Salesfore stays secure?


I would also recommend 1) setting strict permissions on which objects the API user can access and 2) regularly rotating the API user credentials


@Martin, You can also consider Login Hours. A detailed documentation on setting Login restrictions can be found Here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.