Skip to main content

Integrating Salesforce with API Only user

Installing Salesforce API Only

Written by Oskar Johnson Hägglund

API-Only Integration User + OAuth Client Credentials

This guide explains how to securely connect your Salesforce org with Albacross, allowing the Albacross backend service to read data from and write data to Salesforce using a dedicated API-only integration user.
​

This setup follows Salesforce best practices for server-to-server integrations and avoids using human user accounts.

Overview

You will complete the following steps:

  1. Create an API-only Integration User

  2. Enable creation of Connected Apps

  3. Create a Connected App

  4. Enable OAuth Client Credentials Flow

  5. Assign the Execution User

  6. Pre-authorize the Connected App

  7. Create and assign a Permission Set

  8. Share client_id and client_secret with Albacross

1. Create an API-Only Integration User

This user represents Albacross inside your Salesforce org.

1.1 Steps

  1. Go to Setup

  2. Search for Users

  3. Click Users

  4. Click New User

1.2 User Details (example)

  • First Name: Albacross

  • Last Name: Integration

  • Alias: albaint

  • Email: monitored admin or integration mailbox

  • Username: must be globally unique

    (e.g. albacross.integration@yourcompany.com)

1.3 License & Profile

  • User License: Salesforce Integration

  • Profile: Minimum Access – API Only Integrations

This ensures:

  • No Salesforce UI login

  • API access only

  • Least-privilege baseline

Click Save.

2. Create the Albacross Permission Set

We recommend granting access via a Permission Set, not profiles.

2.1 Create Permission Set

  1. Go to Setup

  2. Search for Permission Sets

  3. Click New

  4. Name: Albacross Integration Permissions

  5. License: same as the integration user

  6. Click Save

3. Required Permissions (Permission Set)

Configure the following on Albacross Integration Permissions.

3.1 System Permissions

Enable:

  • ✅ API Enabled

3.2 Object Permissions

Grant Read, Create, Edit access for:

  • Account

  • Contact

  • Lead

  • Opportunity

  • Campaign

  • Task

(Delete access is not required.)

3.3 Field-Level Security

Grant Read and Edit access to:

  • All standard fields used for matching and syncing

  • All custom fields mapped or written by Albacross

3.4 Record-Level Access (Important)

Choose one of the following:

Option A (Recommended)

Grant:

  • View All

  • Modify All

on:

  • Account

  • Contact

  • Lead

  • Opportunity

  • Campaign

  • Task

Option B

Ensure the integration user always has read/write access to all relevant records, even if record ownership changes.

3.5 Record Types

Grant access to all applicable Record Types for the objects above.

3.6 Marketing User (If Campaigns Are Used)

If Albacross interacts with Campaigns:

  • Set Marketing User = TRUE on the integration user

(This is a user-level flag, not in the permission set.)

4. Assign Permission Set to Integration User

4.1 Assign data access Permission Set

  1. Open the Albacross Integration User

  2. Scroll to Permission Set Assignments

  3. Click Edit Assignments

  4. Assign Albacross Integration Permissions created before

  5. Click Save

4.2 Assign Licence Permission Set

  1. Go to Company Settings → Company Information

  2. Scroll to Permission Set Licenses section

  3. Click Go to list »

  4. Find Salesforce API Integration, click

  5. Click Assign Users button

  6. Select Albacross Integration User and click Assign

5. Enable Creation of Connected Apps (One-Time Setup)

In newer Salesforce orgs, creation of Connected Apps is disabled by default and must be enabled explicitly.

Steps

  1. Go to Setup

  2. In Quick Find, search for External Client Apps

  3. Click External Client App Settings

  4. Enable:

    ☑ Allow creation of connected apps

  5. Click Save

6. Create the Albacross Connected App

6.1 Open App Creation

  1. Go to Setup

  2. In Quick Find, search for External Client Apps

  3. Click External Client Apps

  4. Click the button:

    New Connected App

6.2 Basic Connected App Information

Fill in:

  • Connected App Name:

    Albacross Integration

  • API Name: auto-generated

  • Contact Email: Salesforce admin or integration owner

6.3 Enable OAuth Settings

Under API (Enable OAuth Settings):

  • ☑ Enable OAuth Settings

  • Callback URL

    (required even though not used for Client Credentials): https://login.salesforce.com

6.4 OAuth Scopes

Add the following scope:

  • Access the identity URL service (id, profile, email, address, phone)

  • Manage user data via APIs (api)

  • Perform requests at any time (refresh_token, offline_access)

6.5 Client Credentials Flow

In the Client Credentials Flow section:

  • ☑ Enable Client Credentials Flow

6.6 Save the Connected App

Click Save.

⏳ Salesforce may take 2–10 minutes to activate the Connected App.

7. Assign Execution User & Pre-Authorize the Connected App

7.1 Open Connected App Policies

  1. Go to Setup

  2. Search for App Manager

  3. Click App Manager

  4. Find Albacross Integration

  5. Click the dropdown ▾

  6. Click Manage

  7. Click Edit Policies

7.2 Enable Client Credentials Flow

In the Client Credentials Flow section:

  • Run as:

    Select the Albacross API-only Integration User

7.3 Pre-Authorize the Connected App

Still in Edit Policies:

  • Permitted Users → Admin approved users are pre-authorized

Click Save.

8. Pre-Authorize the App via Permission Set

  1. Open Setup → Apps → App Manager

  2. Find Albacross Integration

  3. Click Dropdown ▾ → Manage

  4. In Permission sets section click Manage Permission Sets

  5. Assign Albacross Integration Permissions

  6. Click Save

9. Retrieve client_id and client_secret

  1. Go to back to Setup → Apps → App Manager

  2. Find Albacross Integration

  3. Dropdown ▾ → View

  4. Click Manage Consumer Details

  5. Verify your identity if prompted

Copy:

  • Consumer Key → client_id

  • Consumer Secret → client_secret

10. Provide Credentials in Albacross UI

10.1 Go to Albacross integration settings

  • Ensure that Salesforce is selected

10.2 Select Install using API Only User

  • Click the three dot menu

  • Select Install using API Only User

10.3 Enter the following into the popup

  • Salesforce domain

    (e.g. https://yourcompany.my.salesforce.com)

  • client_id

  • client_secret

⚠️ Please do not send credentials via email or chat.

Did this answer your question?