--- schema_version: "1" id: 4baaa1c53a0209e508d1e21eedc09a9c648248e21287cd1fad92823cfe36a056 title: Give Integration Users API Only Access collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/integration_user.md canonical_url: https://help.salesforce.com/s/articleView?id=platform.integration_user.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 215fe5a3e80abe9e1c6c4725a717fccceb2be1a128579e4b0767a55a7113ea45 description: Following the principle of least privilege, we recommend creating and configuring one Salesforce user for every integration. By assigning a different user to each calling system, domain, use case, or API resource, you restrict each of those users to a unique subset of data and functionality. Setting up dedicated integration users gives you more control over operations and traceability of transactions. And it minimizes the impact if a user or integration is compromised. The Salesforce Integration user license supports this best practice by offering a profile that restricts assigned users to API-only access, ideal for system-to-system integration users. products: - Salesforce Platform release: "264" --- # Give Integration Users API Only Access Following the principle of least privilege, we recommend creating and configuring one Salesforce user for every integration. By assigning a different user to each calling system, domain, use case, or API resource, you restrict each of those users to a unique subset of data and functionality. Setting up dedicated integration users gives you more control over operations and traceability of transactions. And it minimizes the impact if a user or integration is compromised. The Salesforce Integration user license supports this best practice by offering a profile that restricts assigned users to API-only access, ideal for system-to-system integration users. ### Required Editions
Available in: Enterprise, Unlimited, Performance, and Developer Editions.
The Salesforce Integration user license makes the Minimum Access - API Only Integrations profile and the Salesforce API Integration permission set license available for assignment. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_code-264-0-0-production-enus/789bc523-706b-4ae4-8fe9-be6322e38b6b/images/icon_note.png) Note The Minimum Access - API Only Integrations profile replaces the deprecated Salesforce API Only System Integrations profile, which isn't available in newly provisioned orgs. The Minimum Access - API Only Integrations profile enables and also restricts assigned users to operate via API. You can’t turn off the API-only access granted through this profile, but you can change other capabilities, permissions, settings, and data access granted to users via this profile. Find and review the profile in your org to understand what it can and can’t control. Users with this profile can also access objects that are accessible to all users. If your integration users need more access than the profile provides, use permission set licenses to expand the options. The Salesforce API Integration permission set license extends the functionality of the Salesforce Integration user license with many of the same user and object permissions typically available on the System Administrator standard profile. Find and review the Salesforce API Integration permission set license on the Company Information page in Setup to see what it makes available. Assign this or other permission set licenses to users with the Minimum Access - API Only Integrations profile to make more permissions available. Configure and assign permission sets or permission set groups to grant permissions to integration users so they can perform the API operations. Follow the standard process to find and assign the user license and profile and any permission set licenses, permission sets, and permission set groups to your integration user. ## Considerations Users assigned the Salesforce Integration user license and Salesforce API Only System Integrations profile are not authorized to access Salesforce data or features through any user interface. The individual permissions granted through the Salesforce Integration license and the related Minimum Access - API Only Integrations profile can’t be turned off, including on any clones of the profile. By default, orgs in supported editions are granted a limited number of Salesforce Integration user licenses. Contact a Salesforce account executive for information on how to purchase add-on licenses. As a part of integration planning or after assigning permissions to an integration user, decide how users are authorized and authenticated via the API so they can log in to an org. For integrations using a REST-based API, create an external client app and use an OAuth 2.0 flow. For integrations using a SOAP-based API, including the Bulk API, use the SOAP-specific `login()` call. #### See Also - [_Salesforce Developer: Integration Patterns and Practices_](https://developer.salesforce.com/docs/atlas.en-us.integration_patterns_and_practices.meta/integration_patterns_and_practices/integ_pat_intro_overview.htm) - [Licenses Overview](https://help.salesforce.com/s/articleView?id=platform.users_licenses_overview.htm&type=5&language=en_US) - [Standard Profiles](https://help.salesforce.com/s/articleView?id=platform.standard_profiles.htm&type=5&language=en_US) - [Which API Do I Use?](https://help.salesforce.com/s/articleView?id=platform.integrate_what_is_api.htm&release=264.0.0&type=5 "Choose the right Salesforce API for your integration needs. Review the selection of APIs Salesforce offers, including the supported protocols, data formats, and use cases.") - [_REST API Developer Guide:_ Authorization Through External Client Apps or Connected Apps and OAuth 2.0](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm) - [_SOAP API Developer Guide:_ `login()`](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_calls_login.htm)