Secure Salesforce integration is a necessity for organizations that rely on Salesforce to power customer relationships, automate workflows, and connect enterprise applications.ย ย
Whetherย you’reย integrating ERP systems, marketing automation platforms, custom applications, or third-party business tools, ensuring secure authentication is the foundation of every successful integration.ย
Salesforce uses OAuth 2.0 Connected Apps to provide secure, token-based authentication without exposing user credentials. Instead of storing usernames and passwords, Connected Apps generate secure access tokens that allow authorized applications to communicate safely with Salesforce APIs.ย ย
In this guide,ย you’llย learn how OAuth 2.0 Connected Apps work, why they matter, how to configure them correctly, and the security best practices every organization should follow.ย You’llย also discover when partnering with an experienced Salesforce consulting partner can help accelerate implementation and ensure your integration aligns with enterprise security standards.ย ย
Table of Contentsย
- What Is a Salesforce Connected App?ย
- Why OAuth 2.0 Matters for Salesforce Integrationย
- How OAuth 2.0 Connected Apps Workย
- Benefits of Using OAuth 2.0 Connected Appsย
- Step-by-Step Guide to Configure a Connected Appย
- Choosing the Right OAuth Flowย
- Salesforce Integration Security Best Practicesย
- Common Integration Mistakes to Avoid
How to Use OAuth 2.0 Connected Apps for Secure Salesforce Integrationย
What Is a Salesforce Connected App?ย
A Salesforce Connected App acts as the identity gateway between Salesforce and an external application. It enables third-party systems, mobile applications, middleware platforms, and custom-built software to securely access Salesforce APIs using OAuth 2.0 authentication.ย
ย When a Connected App is created, Salesforce generates two important credentials:ย
- Consumer Keyย
- Consumer Secretย
These credentials uniquely identify the external application during authentication and enable secure communication without sharing user passwords. Connected Apps also allow administrators to configure OAuth scopes, session policies, IP restrictions, refresh token settings, and admin approvals for greater control over API access.ย
Why OAuth 2.0 Matters for Salesforce Integrationย
Traditional integrations often relied on usernames and passwords, creating security vulnerabilities and making credential management difficult. OAuth 2.0 solves these problems by replacing passwords with secure access tokens.ย
Instead of exposing login credentials:ย
- Users authorize applications once.ย ย
- Salesforce issues secure access tokens.ย ย
- Applications use these tokens for API requests.ย ย
- Refresh tokens automatically generate new access tokens whenย required.ย ย
This token-based approach significantly reduces the risk of credential theft while providing a secure, scalable authentication framework suitable for enterprise environments.ย
How OAuth 2.0 Connected Apps Workย
The most used authentication mechanism is theย Authorization Code (Web Server) Flow.ย The process follows these steps:ย
Step 1: User Authentication:ย The external application redirects users to Salesforce’s authorization endpoint.ย
Step 2: User Approval:ย The user logs into Salesforce and grants permission to the Connected App.ย
Step 3: Authorization Code: Salesforce redirects the user back to the configured callback URL with a temporary authorization code.ย
Step 4: Token Exchange:ย The application’s backend exchanges the authorization code along with the Consumer Key and Consumer Secret for:ย
- Access Tokenย ย
- Refresh Tokenย ย
Step 5: API Access:ย The application uses the access token to securely access Salesforce APIs.ย
Step 6: Token Refresh:ย When the access token expires, the refresh token obtains a new access token without requiring users to log in again.
Benefits of Using OAuth 2.0 Connected Appsย
Organizations choose OAuth 2.0 Connected Apps because they provide multiple advantages:ย
- Enhanced Security:ย No passwords are stored within external applications.ย
- Better Access Control: Administrators define exactly what applications can access using OAuth scopes.ย
- Enterprise Scalability:ย Connected Apps support web applications, mobile apps, middleware, and server-to-server integrations.ย
- Improved Compliance:ย Audit logs, permission policies, and admin approvals simplify compliance with security regulations.ย
- Seamless User Experience:ย Single Sign-On (SSO) and refresh tokensย eliminateย repeated authentication.
Step 1:ย Create a Connected App in Salesforceย
Step 1.1:ย Navigate to App Managerย –ย Fromย Salesforce Setup, navigate toย Setup โ Apps โ App Manager, then clickย New Connected Appย in the top-right corner.ย
Stepย 1.2:ย Fill in Basic Information –ย Provide the following basic details for your Connected App:ย
- Connected App Nameย โ A descriptive name, such asย My Integration App.ย ย
- API Nameย โ Automatically populated based on the Connected App name.ย ย
- Contact Email โ Required for app management, support, and notifications.ย ย
Stepย 1.3:ย Enable OAuth Settings –ย Select the Enable OAuth Settings checkbox. This displays the OAuth configuration fieldsย requiredย for authentication.ย
Configure the following:ย
- Callback URLย โ The redirect URI where your application receives the authorization response after login. This URLย must exactly matchย the redirect URI used in your authorization request.ย ย
- Selected OAuth Scopesย โ Move the required permissions intoย Selected OAuth Scopes, such as:ย ย
- Manage user data via APIs (api)ย ย
- Perform requests at any time (refresh_token,ย offline_access)ย ย
- Access unique user identifiers (openid)ย ย
Stepย 1.4:ย Save and Continueย
Click Save. Salesforce displays a notice that the changes may takeย 2โ10 minutesย to propagate. This is normal.
Step 2 โ Retrieve Your Consumer Key and Consumer Secretย
After saving the Connected App, open its detail page and clickย Manage Consumer Details. You may be prompted to verify your identity.ย
Copy theย Consumer Keyย (your OAuthย client_id)ย &ย Consumer Secretย (your OAuthย client_secret). Store theย Consumer Secretย securely and treat it like a password. Never commit it to source control or expose it in client-side code.
Step 3 โ Configure Connected App Policies (Optional but Recommended)ย
Underย Manageย on the Connected App, you can configureย additionalย security and access policies.ย
- Permittedย Usersย โ Selectย “Admin approved users are pre-authorized”ย for tighter access control, orย “All users may self-authorize”ย for broader access.ย ย
- IP Relaxationย โ Relax IP restrictions if your integration runs from trusted server IP addresses.ย ย
- Refresh Token Policyย โ Configure the refresh tokenย expirationย policy, such asย “Valid until revoked”ย orย “Expire after a specified period of inactivity.”ย
Step 4 โ Build the Authorization Requestย
From your application, redirect the user’s browser to the authorization endpoint with your client ID, redirect URI, and requested scopes:ย
GETย https://login.salesforce.com/services/oauth2/authorizeย
ย ?response_type=codeย
ย &client_id=YOUR_CONSUMER_KEYย
ย &redirect_uri=https://yourapp.com/oauth/callbackย
ย &scope=api%20refresh_token%20offline_accessย
Useย https://test.salesforce.comย instead of login.salesforce.com ifย you’reย authenticating against a sandbox org.
Step 5 โ Exchange the Authorization Code for Tokensย
Salesforce redirects back to your callback URL with a code parameter. Your backend exchanges it server-side:ย
POSTย https://login.salesforce.com/services/oauth2/tokenย
Content-Type: application/x-www-form-urlencodedย
grant_type=authorization_codeย
&code=AUTHORIZATION_CODEย
&client_id=YOUR_CONSUMER_KEYย
&client_secret=YOUR_CONSUMER_SECRETย
&redirect_uri=https://yourapp.com/oauth/callbackย
A successful response looks like this:ย
{ย
ย “access_token”: “00D…”,ย
ย “refresh_token”: “5Aep…”,ย
ย “instance_url”: “https://yourorg.my.salesforce.com“,ย
ย “id”: “https://login.salesforce.com/id/00D…/005…”,ย
ย “token_type”: “Bearer”,ย
ย “issued_at”: “1719753600”,ย
ย “signature”: “…”ย
}ย
Store theย refresh_tokenย securely and associate it with the user/org. Theย instance_urlย tells you which Salesforce instance to send future API calls to.
Step 6 โ Call the Salesforce REST APIย
Use the access token as a Bearer token against the instance URL returned above:ย
GET {instance_url}/services/data/v60.0/sobjects/Account/001XXXXXXXXXXXXย
Authorization: Bearer 00D…ACCESS_TOKENย
Step 7 โ Refresh Expired Access Tokens
Access tokens expire. Use the refresh token to get a new one without re-prompting the user:ย
POSTย https://login.salesforce.com/services/oauth2/tokenย
Content-Type: application/x-www-form-urlencodedย ย
grant_type=refresh_tokenย
&client_id=YOUR_CONSUMER_KEYย
&client_secret=YOUR_CONSUMER_SECRETย
&refresh_token=YOUR_REFRESH_TOKENย
Troubleshooting Common Errorsย
ย redirect_uri_mismatchย – Theย redirect_uriย in your request must match the Callback URL in the Connected App exactly โ including trailing slashes and http vs. https.ย ย
ย invalid_client_idย – Double checkย you’reย using the Consumer Key (not the Connected App name) and that you copied it without extra whitespace.ย ย
ย invalid_grantย – Usually means the authorization code was already used (codes areย single-use) or has expired (codes are valid for a few minutes only).ย ย
ย “This app isn’t approved by your org’s admin”ย ย
ย Happens when Permitted Users is set to “Admin approved users are pre-authorized.” Add the user to a permission set tied to the Connectedย App, orย relax the policy for testing.ย
Choosing the Right OAuth Flowย
Salesforce supports multiple OAuth 2.0ย flows. Theย most common include:ย
OAuth Flowย ย | Best Forย ย |
Authorization Code Flowย ย | ย ย ย ย ย ย ย ย ย Web applicationsย |
JWT Bearer Flowย ย | ย ย ย ย ย ย ย ย Server-to-server integrationsย ย |
Client Credentials Flowย ย | ย ย ย ย ย ย ย Machine-to-machine communicationย ย |
Device Flowย ย | ย ย ย ย ย ย ย ย IoT devicesย |
User-Agent Flowย ย | ย ย ย ย ย ย ย ย Browser-based applicationsย ย |
Selecting theย appropriate flowย depends on your application’s architecture and security requirements. Connected Apps support several OAuth flows, including Web Server, JWT Bearer, Device, Client Credentials, and User-Agent flows.ย
Salesforce Integration Security Best Practicesย
- Never expose Consumer Secrets in frontend applications.ย ย
- Always use HTTPS callback URLs.ย ย
- Apply the principle of least privilege.ย ย
- Restrict OAuth scopes.ย ย
- Encrypt refresh tokens.ย ย
- Rotate Consumer Secrets regularly.ย ย
- Require admin approval for sensitive integrations.ย ย
- Monitor Connected App usage.ย ย
- Review audit logsย frequently.ย ย
- Apply IP restrictions whenever possible.ย
Conclusionย
Secure Salesforce integration starts with proper authentication, and OAuth 2.0 Connected Apps provide the trusted framework organizations need to protect sensitive business data while enabling seamless connectivity. By replacing passwords with secure access tokens, applying least-privilege access, and following Salesforce security best practices, businesses can build scalable, reliable, and compliant integrations.ย
Whetherย you’reย connecting a custom application, enterprise middleware, or cloud platform, implementing OAuth 2.0 correctly is critical to long-term success. For organizations managing complex ecosystems, partnering with an experiencedย Salesforce consulting partnerย can simplify deployment, reduce security risks, and maximize the value ofย Salesforce consulting servicesย through proven implementation strategies and ongoing optimization.ย
Frequently Asked Questions (FAQs)
What is a Salesforce Connected App?
A Salesforce Connected App allows external applications to securely access Salesforce using OAuth 2.0 authentication instead of usernames and passwords.ย
Why is OAuth 2.0 important for Salesforce integration?
OAuth 2.0 improves security by using access tokens rather than storing user credentials, making Salesforce integrations safer and more scalable.ย
Which OAuth flow is recommended for web applications?
The Authorization Code (Web Server) Flow is the recommended OAuth flow for most server-side Salesforce web integrations.ย ย
Can a Salesforce consulting partner help configure Connected Apps?
Yes. An experiencedย Salesforce consulting partnerย can configure Connected Apps, implement secure authentication,ย optimizeย API access, and ensure enterprise-grade security.ย
What are the benefits of Salesforce consulting services for integrations?
Salesforce consulting servicesย help organizations design secure integration architectures, configure OAuth correctly, improve API performance,ย maintainย compliance, and provide ongoing support.ย
What is the most important OAuth security best practices?
Use HTTPS, encrypt refresh tokens, limit OAuth scopes, rotate Consumer Secrets, require admin approval, andย monitorย Connected App usage regularly.ย
