I am integrating an external program called Checkfront into our Salesforce. I will be authenticating the program using OAuth2.

Where should I begin in terms of authorizing the program, and logging into Salesforce via the API?

In Checkfront, I have the following security details:

  • Consumer Key (Id)
  • Consumer Secret (Id)
  • Authorize Token URL (url)
  • Access Token URL (url)

Edit - As @Developer Wonk pointed out in a comment, Checkfront have a specific Salesforce integration. You can find step-by-step installation instructions on their site:

The Salesforce add-on provides the ability to automatically create new customers (or update existing ones) in Salesforce when a booking is created via Checkfront.

This will ensure your customer records are kept in sync, and you can take full advantage of the many advanced customer management tools Salesforce has to offer.

When enabled, a new account is created in Salesforce after a booking is made. A personal contact is created under the account, along with an event that is tied to the booking date and details. You can further customize this in your Checkfront setup. Please note, an email or phone number must be supplied to create or update the account.

Setup is quick and easy and requires the installation of a Checkfront package in Salesforce. Follow the instructions below to find out how to do this and get your integration up and running in no time!

To enable the Salesforce extension, navigate to Manage > Add-ons in your Checkfront dashboard and click on Setup in the Salesforce tile.

enter image description here

Before clicking on the activate button, you must first click Install the Checkfront Salesforce Package link. This will take you into your Salesforce account where you can proceed to install the Checkfront package.

enter image description here

Click the Continue button to move on to the next step. enter image description here

Next, you must approve the package API access. Simply click Next to continue.

enter image description here

In step 2, you’ll see the view above. Click Install to continue with the package installation. The system will now proceed to install the package.

enter image description here You can now go ahead and complete the activation in Checkfront.

Check the boxes to allow Checkfront to create accounts, contacts and events in Salesforce, then click Activate.

enter image description here

Salesforce will now display a message to let you know that Checkfront is requesting permission to access your basic information and manage data on your behalf. Click the Allow button.

enter image description here

Setup is now complete!

Original post:

I've just taken a quick look at the Checkfront Webhook docs and it doesn't look like they support outbound authentication, only inbound authentication. I believe the details you have - the Consumer Key and Secret, etc - are likely for inbound authentications to Checkfront, not outbound authentications to e.g. Salesforce.

If you aren't able to make authenticated outbound requests, you could make unauthenticated requests - see this article for an explanation. This could pose a security risk, however.

Alternatively, instead of having Checkfront push to Salesforce, you could set Salesforce up to periodically authenticate with Checkfront and check for new records to pull. This won't be real-time, but it will be secure. In that case, you'd store the credentials you posted above as a Named Credential in Salesforce and make callouts that way. This post provides a good overview of Named Credentials and how to use them.

  • Wow those are some great resources. Thank you! I will attempt the secure method first, but I should ask: What are the security risks of unauthenticated requests? I may want to use that as my fall-back plan. – Alex Brigham Sep 29 '15 at 1:53
  • Yes, we have this integration, but it does not work in the way our business needs. We want to build a better, custom integration which we are in control of. Thank you though for exploring this so in-depth. Would you still be able to go over the potential security risks of an unauthorized integration? – Alex Brigham Sep 29 '15 at 13:44
  • The risk is that you're making it possible for anyone to post records to your site without authenticating with it, so if someone somehow found your target (Salesforce) URL and knew how to POST things to it, they could create data in your Salesforce org. It's a pretty remote possibility, but it's less secure than requiring authentication. – Rob Sep 29 '15 at 13:53
  • Okay, makes sense. Thank you very much for your help! – Alex Brigham Sep 29 '15 at 13:54

Following are the some useful link you can refer.

OAuth 2.0 Web Server Authentication Flow

Authenticating Apps with OAuth

Using OAuth to Authorize External Applications


Digging Deeper into OAuth 2.0 on Force.com


  • The first link seemed to be helpful, but it is a bit outdated. You can no longer create Remote access objects. Thank you however for the resources! – Alex Brigham Sep 28 '15 at 15:53
  • Yes... Its not been updated by Salesforce, yet you can refer as there are not much changes. :) – MIX DML Sep 28 '15 at 15:58
  • Hey Prabhat, can you try to post some of the relevant information from those links? Links go stale over the time so link-only answers are generally frowned upon! – Matt Lacey Sep 28 '15 at 22:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.