Credentials, certificates and private connectivity
The security components an integration design specifies: External Client App OAuth setup for JWT bearer and client credentials, Permitted Users and IP policies, named and external credentials (Basic, Custom API keys, Per User OAuth), mutual TLS in both directions, Private Connect, Event Bus encryption, HMAC webhook checks, publish behavior, and what stays in middleware.
Given a use case that includes technical requirements, constraints, or drivers, determine the standards, components, techniques, and security mechanism that should be used.
~8 min read · 17 practice questions ·
What the exam expects
- Configure an External Client App for unattended inbound access: JWT bearer with an uploaded certificate, or client credentials with a run-as integration user, plus Permitted Users and IP policies.
- Model outbound authentication with named credentials and external credentials: Basic, Custom API-key headers, OAuth with Per User or Named Principal identity, and same-name deployment across orgs.
- Specify mutual TLS in the right direction, Private Connect for traffic that must avoid the public internet, and Event Bus encryption for events at rest.
- Verify webhook signatures with HMAC, choose an event's publish behavior, and assign protocol conversion and multi-system compensation to middleware.
Key terms: External Client App (the recommended app framework for new OAuth integrations); external credential (how Salesforce authenticates to a remote system); principal (the identity a callout uses, mapped to permission sets); mutual TLS (both sides present certificates); Event Bus tenant secret (key material for encrypting events at rest).
Key facts
- Detail
- Creation restricted from Spring '26; use External Client Apps
- Detail
- Admin approved users are pre-authorized + profile or permission set
- Detail
- Runs as the assigned integration user; no refresh tokens; My Domain endpoint
- Detail
- Enforce IP restrictions applies only with login IP ranges on the profile
- Detail
- One
callout:class deploys to every org
- Detail
- No longer updated or enhanced
- Detail
- Named Principal only
- Detail
- Upload Mutual Authentication Certificate; Enforce SSL/TLS Mutual Authentication; port 8443
- Detail
- AWS PrivateLink, inbound and outbound, add-on license
- Detail
- Events stored in clear text
- Detail
- Publish Immediately
Sources for this section (11)
- Authorization Through External Client Appsdeveloper.salesforce.com (opens in a new tab)
- JWT Bearer Flowhelp.salesforce.com (opens in a new tab)
- Client Credentials Flowhelp.salesforce.com (opens in a new tab)
- Manage OAuth Access Policieshelp.salesforce.com (opens in a new tab)
- Named Credentials as Callout Endpointsdeveloper.salesforce.com (opens in a new tab)
- Named Credentialshelp.salesforce.com (opens in a new tab)
- Use API Keys in Custom Headershelp.salesforce.com (opens in a new tab)
- Mutual Authentication Certificatehelp.salesforce.com (opens in a new tab)
- Private Connecthelp.salesforce.com (opens in a new tab)
- Encrypt Event Bus Datahelp.salesforce.com (opens in a new tab)
- Platform Event Fieldsdeveloper.salesforce.com (opens in a new tab)
- Why does the client credentials flow satisfy "changes must run under a dedicated user"?
- When is a Per User principal required instead of a named principal?
- When should a platform event use Publish After Commit?
- Which Apex method verifies a webhook's HMAC-SHA256 signature?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Integration Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Integration Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (17 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams