OAuth & Authentication Flows

1// OAuth & Authentication Patterns
2
3// 1. JWT Bearer Token Flow (Server-to-Server)
4public class JwtAuthService {
5    
6    private static final String TOKEN_ENDPOINT = 'https://login.salesforce.com/services/oauth2/token';
7    private static final String CONSUMER_KEY = 'your_connected_app_consumer_key';
8    
9    public static String getAccessToken() {
10        // In production, use Named Credentials instead of manual JWT
11        
12        // Build JWT claims
13        Map<String, Object> claims = new Map<String, Object>{
14            'iss' => CONSUMER_KEY,
15            'sub' => 'integration@company.com',
16            'aud' => 'https://login.salesforce.com',
17            'exp' => String.valueOf(
18                Datetime.now().addMinutes(5).getTime() / 1000
19            )
20        };
21        
22        // In real implementation, sign with certificate
23        // String jwt = createSignedJwt(claims, certificate);
24        
25        HttpRequest req = new HttpRequest();
26        req.setEndpoint(TOKEN_ENDPOINT);
27        req.setMethod('POST');
28        req.setHeader('Content-Type', 'application/x-www-form-urlencoded');
29        req.setBody(
30            'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer' +
31            '&assertion=' + EncodingUtil.urlEncode('jwt_token_here', 'UTF-8')
32        );
33        
34        HttpResponse res = new Http().send(req);
35        Map<String, Object> response = (Map<String, Object>) 
36            JSON.deserializeUntyped(res.getBody());
37        
38        return (String) response.get('access_token');
39    }
40}
41
42// 2. Making authenticated calls to another Salesforce org
43public class CrossOrgService {
44    
45    public static List<Map<String, Object>> queryExternalOrg(String soql) {
46        // Use Named Credential for auth
47        HttpRequest req = new HttpRequest();
48        req.setEndpoint('callout:Other_Salesforce_Org/services/data/v59.0/query?q=' + 
49            EncodingUtil.urlEncode(soql, 'UTF-8'));
50        req.setMethod('GET');
51        req.setHeader('Accept', 'application/json');
52        
53        HttpResponse res = new Http().send(req);
54        
55        Map<String, Object> result = (Map<String, Object>) 
56            JSON.deserializeUntyped(res.getBody());
57        
58        return (List<Map<String, Object>>) 
59            (List<Object>) result.get('records');
60    }
61}
62
63// 3. Custom REST API with proper authentication check
64@RestResource(urlMapping='/api/v1/secure/*')
65global with sharing class SecureRestApi {
66    
67    @HttpGet
68    global static ResponseWrapper getData() {
69        // The @RestResource automatically validates OAuth tokens
70        // No manual auth check needed — Salesforce handles it
71        
72        // But you should check permissions
73        if (!Schema.SObjectType.Account.isAccessible()) {
74            RestContext.response.statusCode = 403;
75            return new ResponseWrapper(false, 'Insufficient permissions');
76        }
77        
78        List<Account> accounts = [
79            SELECT Id, Name, Industry FROM Account LIMIT 10
80        ];
81        
82        return new ResponseWrapper(true, accounts);
83    }
84    
85    global class ResponseWrapper {
86        public Boolean success;
87        public Object data;
88        public String message;
89        
90        public ResponseWrapper(Boolean success, Object data) {
91            this.success = success;
92            this.data = data;
93        }
94        
95        public ResponseWrapper(Boolean success, String message) {
96            this.success = success;
97            this.message = message;
98        }
99    }
100}