# Credentials, certificates and private connectivity

*Integration Architect Study Guide · Design Integration Solutions · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/integration-architect/design-integration-solutions/credentials-certificates-and-private-connectivity*

The security components an integration design specifies: External Client App OAuth setup for JWT bearer and client credentials, Permitted Users and IP policies, named and external credentials (Basic, Custom API keys, Per User OAuth), mutual TLS in both directions, Private Connect, Event Bus encryption, HMAC webhook checks, publish behavior, and what stays in middleware.

- Certification: Salesforce Integration Architect
- Exam section: Design Integration Solutions
- Study guide: https://www.certifyforce.com/study-guide/integration-architect

**Official exam objective:**

> Given a use case that includes technical requirements, constraints, or drivers, determine the standards, components, techniques, and security mechanism that should be used.

## What the exam expects

- Configure an External Client App for unattended inbound access: JWT bearer with an uploaded certificate, or client credentials with a run-as integration user, plus Permitted Users and IP policies.
- Model outbound authentication with named credentials and external credentials: Basic, Custom API-key headers, OAuth with Per User or Named Principal identity, and same-name deployment across orgs.
- Specify mutual TLS in the right direction, Private Connect for traffic that must avoid the public internet, and Event Bus encryption for events at rest.
- Verify webhook signatures with HMAC, choose an event's publish behavior, and assign protocol conversion and multi-system compensation to middleware.

Key terms: **External Client App** (the recommended app framework for new OAuth integrations); **external credential** (how Salesforce authenticates to a remote system); **principal** (the identity a callout uses, mapped to permission sets); **mutual TLS** (both sides present certificates); **Event Bus tenant secret** (key material for encrypting events at rest).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| New connected apps | Creation restricted from Spring '26; use External Client Apps | [Authorization Through External Client Apps](https://developer.salesforce.com/docs/platform/api-rest/guide/intro-oauth-and-connected-apps.html) |
| JWT bearer approval | Admin approved users are pre-authorized + profile or permission set | [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5) |
| Client credentials | Runs as the assigned integration user; no refresh tokens; My Domain endpoint | [Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&type=5) |
| IP Relaxation | Enforce IP restrictions applies only with login IP ranges on the profile | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&type=5) |
| Same-name named credentials | One `callout:` class deploys to every org | [Named Credentials as Callout Endpoints](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm) |
| Legacy named credentials | No longer updated or enhanced | [Named Credentials](https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm&type=5) |
| Custom authentication | Named Principal only | [Use API Keys in Custom Headers](https://help.salesforce.com/s/articleView?id=xcloud.nc_custom_headers_and_api_keys.htm&type=5) |
| Inbound mTLS | Upload Mutual Authentication Certificate; Enforce SSL/TLS Mutual Authentication; port 8443 | [Mutual Authentication Certificate](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_uploading_mutual_auth_cert.htm&type=5) |
| Private Connect | AWS PrivateLink, inbound and outbound, add-on license | [Private Connect](https://help.salesforce.com/s/articleView?id=xcloud.private_connect_overview.htm&type=5) |
| Event bus without encryption | Events stored in clear text | [Encrypt Event Bus Data](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_eventbus_enable.htm&type=5) |
| Default publish behavior | Publish Immediately | [Platform Event Fields](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_define_ui.htm) |

## Check yourself

- Why does the client credentials flow satisfy "changes must run under a dedicated user"?
- When is a Per User principal required instead of a named principal?
- When should a platform event use Publish After Commit?
- Which Apex method verifies a webhook's HMAC-SHA256 signature?

## Sources

- [Authorization Through External Client Apps or Connected Apps and OAuth 2.0](https://developer.salesforce.com/docs/platform/api-rest/guide/intro-oauth-and-connected-apps.html)
- [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5)
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&type=5)
- [OAuth Authorization Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flows.htm&type=5)
- [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&type=5)
- [Give Integration Users API Only Access](https://help.salesforce.com/s/articleView?id=platform.integration_user.htm&type=5)
- [Named Credentials](https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm&type=5)
- [Named Credentials as Callout Endpoints](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm)
- [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&type=5)
- [OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&type=5)
- [Named Credentials Glossary](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_credentials_glossary.htm&type=5)
- [Use API Keys in Custom Headers with Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_custom_headers_and_api_keys.htm&type=5)
- [Named Credential Example: OAuth 2.0 Browser Flow with a Per User Principal](https://help.salesforce.com/s/articleView?id=xcloud.nc_example_oauth_github_per_user.htm&type=5)
- [Using Certificates](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_client_certs.htm)
- [Set Up a Mutual Authentication Certificate for API Login](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_uploading_mutual_auth_cert.htm&type=5)
- [Secure Cross-Cloud Integrations with Private Connect](https://help.salesforce.com/s/articleView?id=xcloud.private_connect_overview.htm&type=5)
- [Encrypt Event Bus Data](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_eventbus_enable.htm&type=5)
- [Crypto Class](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_classes_restful_crypto.htm)
- [Platform Event Fields](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_define_ui.htm)
- [Event Message Durability](https://developer.salesforce.com/docs/platform/pub-sub-api/guide/event-message-durability.html)
- [Integration Patterns Overview](https://architect.salesforce.com/docs/architect/fundamentals/guide/integration-patterns.html)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams