Free sample lesson from the Platform Integration Architect Cert Lab. The full course has 28 lessons and 4 full practice exams.
Get the Cert Lab, $9.99REQ3: Authentication and authorization requirements
You’ll be able to: pick the right authentication approach for each integration direction and explain how tokens, named credentials and apps share responsibility.
Inbound: a client app calling Salesforce
A client application must be authorized as a safe visitor before it can use REST API resources. Use an external client app or a connected app with an OAuth 2.0 authorization flow. OAuth 2.0 authorizes secure data sharing through the exchange of tokens. Every flow has three steps: the app requests access, the authorizing server grants access tokens, and a resource server validates the tokens and approves access. Connected-app creation has been restricted since Spring ’26 and external client apps are recommended.
Outbound: Salesforce calling a service
A named credential holds the endpoint URL, and an external credential holds the authentication settings. Salesforce manages the authentication for callouts that use it, so Apex stays the same whichever authentication you choose. It suits standard protocols such as username and password, OAuth 2.0, AWS Signature Version 4 and signed JWTs.
Other places authentication shows up
| Feature | Authentication fact |
|---|---|
| Pub/Sub API | Supports any mechanism that yields a session ID, including OAuth and username and password; the session times out after 2 hours of inactivity by default |
| Canvas apps | Signed request is the default; OAuth 2.0 is supported; SAML SSO can sit on top |
Exam trap
Hard-coding a key in Apex exposes it to anyone who can view the code, forces changes in every place it is used, and complicates porting it between applications.
Predict, then reveal
An integration must call a partner API with OAuth 2.0 from Apex. What should hold the endpoint and the credentials?
Show the answer
A named credential with an external credential, so Apex stays simple and the secrets aren’t in code.
Try it
- For each integration, write the direction (inbound or outbound) and the authentication choice.
- Create a named credential and call it with callout:Name/path in a Developer Edition org.
- Write who validates the token in your inbound design.
Practice questions
Ten exam-style questions on this lesson. Answer each one before you open it.
Question 1. In an OAuth 2.0 flow, which component validates access tokens and approves access to the protected REST API resource?
- A. A Salesforce profile attached to the end user who logged in
- B. A resource server that guards the data
- C. The client application that sent the request
- D. The browser cache on the end user device
Show the answer and explanation
Answer: B. A resource server validates tokens and approves access.
The authorizing server grants them.
Question 2. How does OAuth 2.0 authorize secure data sharing between applications?
- A. Through shared passwords
- B. Through client certificates installed in each browser
- C. Through the exchange of tokens
- D. Through IP allowlists
Show the answer and explanation
Answer: C. OAuth 2.0 is an open protocol that exchanges tokens.
Tokens carry the granted access.
Question 3. What must a client application be authorized as, to reach REST API resources?
- A. A safe visitor, through an external client app or connected app and OAuth 2.0
- B. A trusted IP address listed in the org network access settings
- C. A Chatter user holding the API Enabled permission in a dedicated profile with login hours set
- D. An administrator holding the Modify All Data permission
Show the answer and explanation
Answer: A. Authorization is done through an app and OAuth flow.
The app requests access on behalf of the client.
Question 4. What does the REST API guide recommend now that creating connected apps is restricted?
- A. Disabling OAuth and using session IDs instead
- B. Creating connected apps in a sandbox and copying them over
- C. Using username and password in a custom Apex class
- D. Using external client apps instead of new connected apps
Show the answer and explanation
Answer: D. Connected-app creation is restricted as of Spring ’26.
Existing connected apps still work.
Question 5. What does a named credential do for Apex callouts?
- A. It registers the endpoint as a trusted site for all other Apex callouts
- B. It encrypts the payload and the response of each callout
- C. Salesforce manages authentication so your code doesn’t have to
- D. It raises the callout limit for the whole transaction
Show the answer and explanation
Answer: C. Salesforce manages authentication for callouts that specify a named credential.
Endpoint and authentication live in one definition.
Question 6. For which authentication protocols are named credentials best suited? (Choose 2.)
- A. OAuth 2.0 flows
- B. Anonymous access for guest users on a public site
- C. Fax-based approval
- D. Signed JWTs for service calls
Show the answer and explanation
Answer: A, D. Standard protocols such as username and password, OAuth 2.0, AWS Signature Version 4 and signed JWTs.
Other mechanisms need custom handling.
Question 7. Which authentication mechanisms does Pub/Sub API support?
- A. Any mechanism that gets a session ID, including OAuth and username and password
- B. OAuth alone, with an access token that the org issues to the client
- C. Client certificates alone, through mutual TLS with the org and no tokens
- D. Mechanisms that use a SAML assertion that is sent in the first message of every stream
Show the answer and explanation
Answer: A. Pub/Sub API supports any mechanism that retrieves the session ID.
The token goes in the metadata header.
Question 8. By default, how long of inactivity ends a session used with Pub/Sub API OAuth tokens?
- A. 24 hours
- B. 15 minutes
- C. 30 seconds
- D. 2 hours
Show the answer and explanation
Answer: D. The session times out after 2 hours of inactivity by default.
A custom timeout can be set in the app.
Question 9. What is the default authentication method for Canvas apps?
- A. Certificate-based mutual TLS for each request
- B. Signed request, the default method
- C. Basic authentication with a username
- D. SAML single sign-on, for every request
Show the answer and explanation
Answer: B. Signed request is the default for Canvas apps.
OAuth 2.0 is also supported.
Question 10. Why is hard-coding an API key in Apex source a problem?
- A. It slows down every callout that reads the stored key
- B. The key expires after each deployment and Support must reissue it
- C. Anyone who can view the source code can see the embedded secret
- D. It reduces the callout limit available to the whole org
Show the answer and explanation
Answer: C. Anyone with source access sees the secret.
It also needs changes in every place when the key rotates.
Before you move on
1. Who validates tokens?
Show answer
The resource server.
2. What do named credentials hold?
Show answer
The endpoint URL and, with external credentials, the authentication settings.
3. Pub/Sub API idle session timeout?
Show answer
2 hours by default.
Key takeaways
- Use an external client app or connected app with OAuth 2.0 for inbound calls.
- Use named credentials plus external credentials for outbound calls.
- Keep secrets out of code and match the mechanism to the API (Pub/Sub, Canvas, REST).
Sources
- Salesforce Developers: i: Authorization Through External Client Apps or Connected Apps and OAuth 2.0
- Salesforce Developers: Apex Developer Guide: Named Credentials as Callout Endpoints
- Trailhead: Secure Secrets Storage: Protect Secrets Using Platform Features
- Salesforce Developers: Pub/Sub API: Authentication
- Salesforce Developers: Canvas Developer Guide: Authentication
Checked against Trailhead, Salesforce developer documentation, Salesforce Help and the exam guide on Oct 25, 2026. Questions follow the Platform Integration Architect exam guide.
Liked this lesson?
There are 27 more like it, plus section checks, flashcards and 4 full 60-question practice exams.
Get the Cert Lab, $9.99