Following the principle of least privilege, we recommend creating and configuring one
Salesforce user for every integration. By assigning a different user to each calling system,
domain, use case, or API resource, you restrict each of those users to a unique subset of
data and functionality. Setting up dedicated integration users gives you more control over
operations and traceability of transactions. And it minimizes the impact if a user or
integration is compromised. The Salesforce Integration user license supports this best
practice by offering a profile that restricts assigned users to API-only access, ideal for
system-to-system integration users.
Required Editions
| Available in: Enterprise, Unlimited,
Performance, and Developer Editions.
|
The Salesforce Integration user license makes the Minimum Access - API Only Integrations
profile and the Salesforce API Integration permission set license available for
assignment.
The Minimum Access - API Only Integrations profile enables and also restricts assigned
users to operate via API. You can’t turn off the API-only access granted through this
profile, but you can change other capabilities, permissions, settings, and data access
granted to users via this profile. Find and review the profile in your org to understand
what it can and can’t control. Users with this profile can also access objects that are
accessible to all users. If your integration users need more access than the profile
provides, use permission set licenses to expand the options.
The Salesforce API Integration permission set license extends the functionality of the
Salesforce Integration user license with many of the same user and object permissions
typically available on the System Administrator standard profile. Find and review the
Salesforce API Integration permission set license on the Company Information page in
Setup to see what it makes available. Assign this or other permission set licenses to
users with the Minimum Access - API Only Integrations profile to make more permissions
available. Configure and assign permission sets or permission set groups to grant
permissions to integration users so they can perform the API operations.
Follow the standard process to find and assign the user license and profile and any
permission set licenses, permission sets, and permission set groups to your integration
user.
Considerations
Users assigned the Salesforce Integration user license and Salesforce API Only System
Integrations profile are not authorized to access Salesforce data or features
through any user interface. The individual permissions granted through the
Salesforce Integration license and the related Minimum Access - API Only
Integrations profile can’t be turned off, including on any clones of the
profile.
By default, orgs in supported editions are granted a limited number of Salesforce
Integration user licenses. Contact a Salesforce account executive for information on
how to purchase add-on licenses.
As a part of integration planning or after assigning permissions to an integration user,
decide how users are authorized and authenticated via the API so they can log in to an org.
For integrations using a REST-based API, create an external client app and use an OAuth 2.0
flow. For integrations using a SOAP-based API, including the Bulk API, use the SOAP-specific
login() call.
