The Ultimate Salesforce Integration Guide
The Ultimate Salesforce Integration Guide
Common Examples:
- A web portal sending form data into Salesforce
- An ERP system creating Opportunities or syncing inventory
- A mobile app retrieving customer data from Salesforce 🔄 Inbound Integration
(External System ➡️ Salesforce)
When to Use:
- External system needs to write or read Salesforce data
- You want Salesforce as the data store
- Scenarios where external system initiates the process
When to Use:
- You need to send Salesforce data to an external system
- Salesforce is the source of truth or initiator
- Real-time sync or automation based on record changes
1. Authorization Endpoint
Purpose: Used to initiate the OAuth flow and get the user's authorization to access data.
Typical URL: https://login.salesforce.com/services/oauth2/authorize
What Happens Here?
- The user is redirected to this endpoint
- They log in and approve the app’s access
- Salesforce responds with an authorization code
2. Token Endpoint
Purpose: Used to exchange the authorization code for an access token.
Typical URL: https://login.salesforce.com/services/oauth2/token
What Happens Here?
- A POST request is made with:
- grant_type=authorization_code
- client_id, client_secret
- code (from the previous step)
- Salesforce returns an access token (and optionally a refresh token)
- This token is used to call Salesforce APIs
OAuth Flow
OAuth Flow Use Case Example
Authorization Code Web apps needing user Portal login to Salesforce
login
Client Credentials (JWT) Server-to-server auth Middleware sending data to
without user interaction Salesforce
Username-Password Simple integration (less Legacy systems with basic
secure) auth
Refresh Token Keep session alive without Background processes
re-authenticating
Device Flow (newer) IoT or limited UI devices Salesforce integrations on
kiosks
Bonus Tips
- Use Named Credentials in Salesforce to simplify managing OAuth tokens for outbound
callouts
- Use Connected App + Auth Provider when allowing external apps/users to connect to
Salesforce
- Use refresh tokens to keep long-running integrations alive without re-authorization
- Monitor OAuth usage in Salesforce under Setup → Connected Apps OAuth Usage
OAuth 2.0 Flowchart:
{
"authorization_code_request": {
"url": "https://login.salesforce.com/services/oauth2/authorize",
"params": {
"client_id": "your-client-id",
"response_type": "code",
"redirect_uri": "https://your-app.com/callback",
"scope": "full",
"state": "secureRandomString"
},
"example_response": {
"code": "authorization_code_from_salesforce"
}
},
"token_request": {
"url": "https://login.salesforce.com/services/oauth2/token",
"params": {
"grant_type": "authorization_code",
"client_id": "your-client-id",
"client_secret": "your-client-secret",
"code": "authorization_code_from_salesforce",
"redirect_uri": "https://your-app.com/callback"
},
"example_response": {
"access_token": "access_token_from_salesforce",
"refresh_token": "refresh_token_from_salesforce",
"instance_url": "https://your-org.salesforce.com",
"id": "https://login.salesforce.com/id/00Dxx0000001ABeU",
"token_type": "Bearer",
"issued_at": "1587056239025",
"signature": "oauth_signature"
}
}
}