Hardening integration tokens, sessions and credentials
Secure inbound integrations with IP rules that JWT bearer always enforces, Permitted Users and Use Any API Client, refresh token policies, jti replay protection, secret rotation, app-level scopes and event permissions; secure outbound callouts with AWS Signature v4 and JWT external credentials and guest-safe named principals.
Given a use case, create a security solution for inbound or outbound integrations.
~7 min read · 12 practice questions ·
What the exam expects
- Diagnose inbound token failures and leaks: IP restrictions under JWT bearer, Use Any API Client bypassing Permitted Users, leaked consumer secrets, credentials in URLs.
- Choose the refresh token policy that matches a reauthorization requirement, and block JWT replay with
jti. - Apply least privilege at the OAuth layer (app-assigned scopes) and on platform events (read to subscribe, create to publish), and know revocation isn't instant.
- Replace hand-built request signing with AWS Signature v4 or JWT external credentials, and configure principals that guest users can use.
Key terms: Permitted Users (whether users self-authorize an app or must be pre-authorized by profile or permission set); IP Relaxation (whether org IP restrictions apply to an app); refresh token policy (how long a refresh token can mint new sessions); jti claim (unique JWT ID Salesforce checks for reuse); external credential principal (the identity, Named Principal or Per User, that a callout authenticates as).
Key facts
- Detail
- Always enforced, whatever IP Relaxation says
- Detail
- Accesses any connected app, even admin-approved only
- Detail
- Valid until revoked
- Detail
- 3 minutes after
exp
- Detail
- Never issued by JWT bearer or client credentials
- Detail
- My Domain only; scopes assigned to the app
- Detail
- Within 10 minutes
- Detail
- RS256 (default) or RS512
- Detail
- Named principal only; assign User External Credentials manually
Sources for this section (6)
- Manage OAuth Access Policieshelp.salesforce.com (opens in a new tab)
- JWT Bearer Flowhelp.salesforce.com (opens in a new tab)
- Client Credentials Flowhelp.salesforce.com (opens in a new tab)
- Pub/Sub API General Considerationsdeveloper.salesforce.com (opens in a new tab)
- JWT External Credentialhelp.salesforce.com (opens in a new tab)
- Enable User External Credentialshelp.salesforce.com (opens in a new tab)
- Why can't Relax IP restrictions fix a JWT bearer login failure after an IP change?
- When should an app use Expire refresh token if not used for n?
- Why might a user without the app's permission set still authorize an admin-approved app?
- What permissions does a Pub/Sub API client need to subscribe to one event and publish another?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Integration Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Integration Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (12 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams