Definition
In Salesforce, an open authorization protocol used by connected apps to grant third-party applications secure, token-based access to Salesforce data without exposing user credentials, supporting flows like Web Server, JWT Bearer, and Device.
Real-World Example
At their company, a CRM manager at Summit Group leverages OAuth to centralize important business data in one place. With OAuth configured to match their workflow, the team can quickly find relevant information, track changes over time, and generate reports that drive strategic decisions.
Why OAuth Matters
In Salesforce, OAuth is an open authorization protocol used by connected apps to grant third-party applications secure, token-based access to Salesforce data without exposing user credentials. OAuth supports several flows for different scenarios: Web Server Flow (for web apps with server-side code), JWT Bearer Flow (for server-to-server integration without user interaction), Device Flow (for devices with limited input), User-Agent Flow (for client-side apps), and others. Each flow handles authentication differently but all produce access tokens that the application uses for API calls.
OAuth is foundational to modern Salesforce integration security. Compared to older approaches like password-based authentication or API keys embedded in code, OAuth provides better security through token-based access that can be revoked, scoped to specific permissions, and refreshed without re-authentication. Mature integration practices use OAuth for everything: connected apps, third-party tools, custom integrations, and the Salesforce CLI itself. Knowing the right OAuth flow for each scenario is part of being effective with Salesforce integration security.
How Organizations Use OAuth
- •TerraForm Tech — Uses JWT Bearer Flow for server-to-server integrations, eliminating the need to store and rotate user passwords.
- •Quantum Labs — Built their connected app authentication around OAuth Web Server Flow for user-facing scenarios.
- •CodeBridge — Trains developers on the various OAuth flows so they pick the right one for each integration scenario.