# Hardening integration tokens, sessions and credentials

*Integration Architect Study Guide · Build Solution · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/integration-architect/build-solution/hardening-integration-tokens-sessions-and-credentials*

Secure inbound integrations with IP rules that JWT bearer always enforces, Permitted Users and Use Any API Client, refresh token policies, jti replay protection, secret rotation, app-level scopes and event permissions; secure outbound callouts with AWS Signature v4 and JWT external credentials and guest-safe named principals.

- Certification: Salesforce Integration Architect
- Exam section: Build Solution
- Study guide: https://www.certifyforce.com/study-guide/integration-architect

**Official exam objective:**

> Given a use case, create a security solution for inbound or outbound integrations.

## What the exam expects

- Diagnose inbound token failures and leaks: IP restrictions under JWT bearer, Use Any API Client bypassing Permitted Users, leaked consumer secrets, credentials in URLs.
- Choose the refresh token policy that matches a reauthorization requirement, and block JWT replay with `jti`.
- Apply least privilege at the OAuth layer (app-assigned scopes) and on platform events (read to subscribe, create to publish), and know revocation isn't instant.
- Replace hand-built request signing with AWS Signature v4 or JWT external credentials, and configure principals that guest users can use.

Key terms: **Permitted Users** (whether users self-authorize an app or must be pre-authorized by profile or permission set); **IP Relaxation** (whether org IP restrictions apply to an app); **refresh token policy** (how long a refresh token can mint new sessions); **`jti` claim** (unique JWT ID Salesforce checks for reuse); **external credential principal** (the identity, Named Principal or Per User, that a callout authenticates as).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| JWT and SAML bearer IP rules | Always enforced, whatever IP Relaxation says | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| Use Any API Client | Accesses any connected app, even admin-approved only | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| Default refresh token policy | Valid until revoked | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| JWT clock-skew buffer | 3 minutes after `exp` | [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5) |
| Refresh tokens | Never issued by JWT bearer or client credentials | [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5), [Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&type=5) |
| Client credentials endpoint | My Domain only; scopes assigned to the app | [Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&type=5) |
| Pub/Sub permission change lag | Within 10 minutes | [Pub/Sub API General Considerations](https://developer.salesforce.com/docs/platform/pub-sub-api/guide/considerations.html) |
| JWT external credential algorithms | RS256 (default) or RS512 | [JWT External Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_jwt_ext_cred.htm&language=en_US&type=5) |
| Guest users and external credentials | Named principal only; assign User External Credentials manually | [Enable User External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_user_external_credentials.htm&language=en_US&type=5) |

## Check yourself

- Why can't Relax IP restrictions fix a JWT bearer login failure after an IP change?
- When should an app use Expire refresh token if not used for n?
- Why might a user without the app's permission set still authorize an admin-approved app?
- What permissions does a Pub/Sub API client need to subscribe to one event and publish another?

## Sources

- [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5)
- [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5)
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&type=5)
- [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5)
- [Authorization Through External Client Apps or Connected Apps and OAuth 2.0](https://developer.salesforce.com/docs/platform/api-rest/guide/intro-oauth-and-connected-apps.html)
- [Manage API Access](https://help.salesforce.com/s/articleView?id=xcloud.security_api_access_control_about.htm&type=5)
- [Pub/Sub API General Considerations](https://developer.salesforce.com/docs/platform/pub-sub-api/guide/considerations.html)
- [Handle Errors (Pub/Sub API)](https://developer.salesforce.com/docs/platform/pub-sub-api/guide/handling-errors.html)
- [Remote Process Invocation—Fire and Forget](https://developer.salesforce.com/docs/atlas.en-us.integration_patterns_and_practices.meta/integration_patterns_and_practices/integ_pat_remote_process_invocation_fire_forget.htm)
- [Create or Edit an AWS Signature v4 External Credential](https://help.salesforce.com/s/articleView?id=sf.nc_create_edit_awssig4_ext_cred.htm&type=5)
- [Create or Edit a JWT External Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_jwt_ext_cred.htm&language=en_US&type=5)
- [Named Credentials as Callout Endpoints](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm)
- [Enable User External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_user_external_credentials.htm&language=en_US&type=5)
- [Enable External Credential Principals](https://help.salesforce.com/s/articleView?id=xcloud.nc_enable_ext_cred_principal.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 12 linked practice questions, and unlimited timed mock exams are included with the Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams