Salesforce: REST API Server-to-Server
By: Hugo Lemos
Tags: Rest Api, Salesforcerest, Salesforce

A quick-start for those new to the REST APIs in Salesforce.

Connected App

The configuration of a connected App is required to enable an external application to integrate with the Salesforce REST APIs.

Two trailhead links that teaches the basics:

Salesforce Trailhead Module: Connected App Basics

Salesforce Trailhead Project: Build a Connected App for API Integration

Notes:

One connected app per environment will be required to enable the REST API integration.

Connected App OAuth access policy:

a. Define which users can access. In most cases the setting Permitted Users is set to Admin approved users are pre-authorized. This way profiles and permission sets can be used to control access. Please have in mind that the Integration User will require the permission set or the profile that was added.

b. Define from where the users can access the REST API: IP relaxation

Define which users can access. In most cases the setting Permitted Users is set to Admin approved users are pre-authorized. This way profiles and permission sets can be used to control access. Please have in mind that the Integration User will require the permission set or the profile that was added. Define from where the users can access the REST API: IP relaxation Consumer key and consumer secret to be stored in a safe location!

For better performance, it’s suggested the API clients to accept and support compression as defined by the HTTP 1.1 specification.

Salesforce requires all connections to use TLS 1.2 or higher.

Supports both JSON and XML. XML requests are supported in UTF-8 and UTF-16, and XML responses are provided in UTF-8.

Server-to-Server Authentication options

Salesforce uses OAuth 2.0 for REST API calls. There are two possible options for authentication:

A) OAuth 2.0 JWT Bearer Flow

Preferable option for server-to-server authentication as it is more secure.

It requires JWT digitally signed using RSA SHA256.

Configuration Steps:

Generate a public/private key pair using the RSA Key format X509

X509 are generated with Open SSL. For more details check: Create a Private Key and Self-Signed Digital Certificate Upload public certificate to Connected app

On the Connected App:

a. Select Enable OAuth Settings .

b. Select click on Use digital signatures

c. Upload previously generated self-signed certificated. Share private key with the external application IT team.

Authentication Flow:

1. A first request is sent to perform the authentication. The RSA Private key is then used to sign the request. The HTTP endpoint is: https://[Login|Test].salesforce.com/services/oauth2/token.

2. When the authentication is successful, Salesforce replies with the access token and with the URL that should be used in the follow-up requests.

! This authentication flow never issues a refresh token.

B) OAuth 2.0 Username-Password Flow for Special Scenarios

From Salesforce:

“Use it only if there is a high degree of trust between the resource owner and the client, the client is a first-party app, Salesforce is hosting the data, and other grant types aren’t available. In these cases, set user permissions to minimize access and protect stored credentials from unauthorized access.”

Authentication Flow:

1. The connected app requests an access token by sending the user’s login credentials to the Salesforce token endpoint. HTTP endpoint should be https://[Login|Test].salesforce.com/services/oauth2/token.

2. After verifying the request, Salesforce grants an access token to the connected app. The access token can be used in multiple calls until it gets expired. The HTTP Response also returns the URL that should be used in the following requests.