OAuth flow selection and integration access controls
Pick the OAuth 2.0 flow from three questions about the client, plan for the username-password flow's retirement and the connected app creation restriction, and set least-privilege access, app session policies, real-time blocking, CORS and field-level protection for each integration.
Given a use case, identify integration security / authentication / authorization requirements.
~8 min read · 17 practice questions ·
What the exam expects
- Choose the OAuth 2.0 flow for an integration from who is present, whose identity the calls run as, and whether the client can keep a secret.
- Replace the username-password flow and register new integrations as external client apps.
- Grant least-privilege access to integration users: Apex class access, restriction rules, View All for change event subscribers.
- Apply app session policies (timeout, high assurance, block) and transaction security policies that block in real time.
- Pick protections for browsers and fields: CORS allowlist, deterministic encryption for matching, payload encryption past an untrusted broker.
Key terms: PKCE (Proof Key for Code Exchange, protects the authorization code); refresh token rotation (each refresh returns a new token and invalidates the old one); high assurance session (identity verified with a second factor); restriction rule (filters records a user can already access); deterministic encryption (same plaintext gives the same ciphertext, so matching works).
Key facts
- Detail
- Blocked by default in orgs created Summer '23 or later
- Detail
- Enforced February 20, 2027; orgs from Summer '26 can't enable it
- Detail
- Creation restricted as of Spring '26; use external client apps
- Detail
- App, then profile, then org Session Settings
- Detail
- API logins blocked: no user approval step
- Detail
- Block, Notifications
- Detail
- 2 active (Enterprise, Developer); 5 (Performance, Unlimited)
- Detail
- View All Records for the object (View All Data for all entities)
Sources for this section (7)
- OAuth Authorization Flowshelp.salesforce.com (opens in a new tab)
- Username-Password Flow Retirementhelp.salesforce.com (opens in a new tab)
- Authorization Through External Client Apps or Connected Appsdeveloper.salesforce.com (opens in a new tab)
- Manage Session Policieshelp.salesforce.com (opens in a new tab)
- Transaction Security Policy Typeshelp.salesforce.com (opens in a new tab)
- Restriction Ruleshelp.salesforce.com (opens in a new tab)
- Change Event Permissionsdeveloper.salesforce.com (opens in a new tab)
- Why does a high assurance requirement break a JWT bearer integration?
- When should a microservice use the token exchange flow?
- What happens when a rotated-out refresh token is presented?
- Why does a Pub/Sub API change event subscriber need View All Records?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Integration Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Integration Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (17 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams