48 votes
Accepted

Use a Named Credential with API key?

Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named ...
user avatar
  • 433k
27 votes
Accepted

Mavensmate: Getting error client identifier invalid while authentication to salesforce

To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce. MavensMate's codebase has ...
user avatar
21 votes
Accepted

When does it make sense to add a Connected App to a Managed Package?

Packaging the connected app allows administrators who install the app to control which of their users can use the application. Rather than the coarse ability to block or not block an app (seen in ...
user avatar
  • 2,499
17 votes
Accepted

Pros and cons of user-agent flow vs web server flow

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
user avatar
  • 433k
14 votes
Accepted

What is "Sfdx Auth Url" attribute used for?

The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential. In fact it is the easiest way to authenticate through CLI. ...
user avatar
12 votes
Accepted

Salesforce certificate authentication for users

It's possible using the Mutual authentication feature which allows you to setup certificates for users so they are authenticated via a certificate instead of a username/password. Please note that this ...
user avatar
12 votes
Accepted

How does lightning authentication work?

There has been a lot of discussion around speed of development and reusable components and while I do think we get decent marks for that the real promise of lightning components is that for the first ...
user avatar
  • 9,974
9 votes

"Session expired or invalid" problem calling an @RestResource from Apex in Winter '15 preview; UserInfo.getSession returns null for Force.com Sites

Support have come back with: confirmed with R&D that this is not a BUG rather a security update that is introduced in Winter'15 release and advise: affected customers will need to adjust ...
user avatar
  • 130k
9 votes

Two factor authentication for Community Users

Two Factor Authentication is supported for Community Users as pointed out by Rob Cowell. For standard user license type, you my be accustomed to enabling 2FA via the System Permission Two-Factor ...
user avatar
  • 3,976
9 votes
Accepted

How can I avoid Salesforce expiring my password and/or token without warning?

Your token didn't expire, your password did. As an administrator, you can make a Permission Set with the Password Never Expires permission, and assign it to your user account (affects only yourself), ...
user avatar
  • 433k
9 votes

Mavensmate: Getting error client identifier invalid while authentication to salesforce

MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see. There is the chance it could ...
user avatar
8 votes
Accepted

frontdoor.jsp for Customer Portal user? How to authenticate a portal user with session id?

This discussion forum thread suggests that you can do this with https://<instance>.salesforce.com/secur/frontdoor.jsp?sid=<sessionId>&orgId=<orgId>&portalId=<portalId> ...
user avatar
  • 16.2k
8 votes

Facebook as Auth Provider - no username or email passed in Auth.Data

Fill the field 'User Info Endpoint URL' (on Auth provider page ) with this and test it out. https://graph.facebook.com/me?fields=first_name,last_name,email Reason for suggestion is: Facebook api v2....
user avatar
8 votes
Accepted

Is there a better way to do two-factor authentication?

There's two main ways to use 2FA. The first is where you enter a code each time you log in, and the second is where you authenticate the login through a mobile app. If you install the Salesforce ...
user avatar
  • 433k
8 votes
Accepted

Salesforce Server-To-Server API authentication

I believe the JWT Bearer OAuth 2.0 flow is the way to go here. There is some setup involved (you need to generate/use an X509 certificate, use the user-agent or web-server flows to authorize once), ...
user avatar
  • 48.1k
7 votes
Accepted

Is login history only stored for 6 months?

Yes, the logs go back just six months. Even salesforce's Data Recovery option only goes back three months. If you're concerned that you need a longer audit trail, there are ways of doing this. Two ...
user avatar
  • 433k
7 votes
Accepted

Accessing Named Credentials' data in apex

You can use Named Credentials to create an End point URL with necessary parameters. For example, if this is is your URL: https://www.someendpointurl.com?param1=named&param2=credentials In Apex, ...
user avatar
  • 1,967
7 votes

error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration

I had the same problem. I found that callback url in the connected app should be the same as you have in your redirect_uri. I tested it with a tool called postman, maybe that can help you as well.
user avatar
7 votes
Accepted

How is this possible to use the Salesforce CLI after changing my user's password?

Salesforce CLI use an access token to connect to your org. This means that even if you change your password or even your username it will still be connected to your org trough your username. If you ...
user avatar
7 votes

Determine whether running user is logged in from within Trusted IP Range (from Apex)

You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as ...
user avatar
7 votes

Mavensmate: Getting error client identifier invalid while authentication to salesforce

As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost ...
user avatar
  • 9,516
7 votes
Accepted

Testing Community "Passwordless Login" using the System.UserManagement Class

I think the sad truth is that there is currently (as at v47.0) no support in Apex for testing those methods or the corresponding TwoFactorMethodsInfo API. I'm asking around for verification, but the ...
user avatar
6 votes
Accepted

"Session expired or invalid" problem calling an @RestResource from Apex in Winter '15 preview; UserInfo.getSession returns null for Force.com Sites

Salesforce backed out this across-the-board change and made it a versioned changed. API Version 31 and earlier will continue to return the session ID from UserInfo.getSessionId() when in the Sites ...
user avatar
  • 2,325
6 votes

When does it make sense to add a Connected App to a Managed Package?

Let's say that you have a salesforce application that communicates with an API you've developed. That API connects to salesforce using the Consumer Secret and Consumer Key of your connected app, and ...
user avatar
6 votes
Accepted

How to connect to Salesforce REST API without OAuth? How does Jitterbit do it?

You can use any login call, and you'll be able to use that session ID with REST. This probably isn't clearly documented, but there are similar questions on here (and other forums) that do explain this....
user avatar
  • 433k
6 votes
Accepted

When to use username & password flow to obtain a token

The username-password flow is only intended for development. It is insecure and should never be used for a production application. As this help topic helpfully warns: This OAuth authentication flow ...
user avatar
  • 433k
6 votes
Accepted

How do I authorize access to a managed application in another org?

I just went through something similar where the final destination varied depending on the customer so a static callback int he code did not work. What I did on our LMA org to handle this was: Placed ...
user avatar
  • 53.1k
6 votes
Accepted

Sandbox verification emails

Have a look at the SandboxPostCopy Interface. It should be possible to have Apex run after the Sandbox is created and then modify the specific User records email address fields.
user avatar
6 votes

What method to use in a batch apex in order to get authentication token from a remote server?

I just had a similar requirement that I'm filling by using Platform Cache to hold the token and its expiration timestamp. It looks basically like this: public class WSAuthentication { public ...
user avatar
6 votes
Accepted

How does a website that accesses my salesforce metadata/data authorize against my org?

Connected Apps are "global metadata". They don't need to be present in the target org, just in a single, persistent org that you control. If you maintain that Connected App in your own org, you can ...
user avatar
  • 86.8k

Only top scored, non community-wiki answers of a minimum length are eligible