Salesforce connected app consumer secrets, private keys, and OAuth refresh tokens are server-only. Use a dedicated least-privilege integration user with the OAuth JWT bearer flow for server-to-server calls, and expose only the fields each client actually needs.
Identifies the app in OAuth flows. Not sufficient alone to call APIs.
Mint access tokens for the integration user.
Act as the authorized user until revoked.
Assign a minimal permission set limited to the objects and fields the integration reads.
Certificate-based tokens avoid storing passwords and can be revoked per connected app.
Select explicit fields instead of returning whole records to clients.
It stores a real password and bypasses MFA protections.
A leaked token then grants full org access.
String-concatenated queries allow SOQL injection. Escape or bind values.
Store the instance name and access credentials in the vault, call explicit sobject or query endpoints from an edge pipeline, and slim results to the contact or account fields the client renders.
No. Salesforce tokens would be exposed and CORS will usually block the call. Use a server or edge proxy.
You should not store Salesforce credentials in React client code. Vault-inject OAuth or integration tokens at the edge; React calls one public client token URL. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Salesforce credentials in JavaScript / HTML client code. Edge pipeline attaches Bearer tokens so static sites never embed secrets. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To merge salesforce contacts with hubspot crm one api, use one RealComposer pipeline with parallel steps. Parallel fetch Salesforce Contact and HubSpot CRM contact into one JSON object. Your Frontend / Web app makes one request instead of several sequential upstream calls.
You should not store Salesforce credentials in Bubble.io client code. RealComposer mediates Salesforce REST for Bubble workflows. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To merge salesforce opportunities with stripe mrr data, use one RealComposer pipeline with parallel steps. Salesforce Opportunity and Stripe subscription MRR merged for dashboards. Your Frontend / Web app makes one request instead of several sequential upstream calls.
To combine salesforce with plaid financial data, use one RealComposer pipeline with parallel steps. Salesforce household and Plaid balances in one regulated edge response. Your Mobile App (iOS & Android) app makes one request instead of several sequential upstream calls.
OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user account on another service without handling the user password. The user approves requested scopes, and the application receives an access token it uses to call the service API.
Principle of Least PrivilegeThe principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.
Field MaskingField masking is the technique of applying a list of allowed or excluded field paths to an API response so only selected properties are returned. Masks can be allowlists that keep named fields or denylists that remove sensitive or unnecessary ones.