Is there a standard mechanism for storing external app oauth tokens in Salesforce (smth like connected app but in the opposite direction)? I need my SF users to authorize within a 3rd party app and then store the tokens [somewhere] so that they wouldn't need to authorize each time (the 3rd party app supports oauth2).

If I'm missing something obvious in the integration documentation please help me out.

Or will I have to handle tokens storage by myself? If so, then what would be the best option?

  1. storing them as hierarchy custom settings -- doesn't seem secure enough though
  2. creating a separate app that would orchestrate authorization
  3. are there other options?
  • 1
    Is this a managed package? If so a private custom setting is considered ok to store the tokens. Otherwise you could look into a custom object with encrypted fields to store them, or you could do your own encryption causing admins to be able to decrypt rather than just view encrypted. It all depends on how "secure" you want it to be. Even if you custom encrypt an admin could look at the code and decrypt it.....
    – Eric
    Aug 24 '15 at 16:26
  • @Eric thank you for your answer. Unfortunately, it's not a part of a managed package. Custom encryption/decryption is an option to consider, it is less vulnerable than storing plain tokens anyway.
    – bananka
    Aug 24 '15 at 16:35
  • @bananka You could make use of Custom Settings to store these.
    – Sapthagiri
    Aug 25 '15 at 4:30

You could create a managed package explicitly for storing the sensitive oauth token data in a protected hierarchy custom setting.

Then expose global functionality from the managed package to setup the token and authorize to the 3rd party app.

It does mean one more org and project to manage. However, at no point could anyone access the stored tokens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.