function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion

How to use REST API without OAuth

I've been struggling (wasting) a lot of time with some problem. Let me describe it.


I have a mobile HTML5 app and I want to integrate it with Salesforce (basically, I want to use it as a database). I need to implement the user profile feature and store the user's details somewhere on Salesforce. A user of my app doesn't have a Salesforce account. All the interactions between Salseforce and my app must be hidden from the user. However, it seems like there's no way to use your REST API without OAuth. OAuth is a security implementation that allows users to access their Salesforce data without having to enter their password, so it's not suitable for me at all. I want to "register" my app on Salesforce, so it should become "trusted". The question is how do I securely use the API without OAuth?


I managed to find that thread (the author's problem is similar to my problem), but no-one answered it:


I also found an article, which describes how to create an "anonymous" API, but such an API has no protection at all (without additional efforts) so everyone can read/amend/delete my data:

Currently, I'm thinking that this approach is the only way to go. I can protect (sort of) my app by using a secret key, so when my API recieves a request, it must verify whether the requester provided the correct key; then the API can decide whether to reject or accept the request. This approach requires a lot of work, though.


You can acheive this.




1.Create a public web-service inside salesforce.

2.Now create a site in your salesforce org

3.Call your public web-service from the sites url.


This way you dont need to provide username and password.



Hi Iskradev,


You can create a public Sites page that exposes the mobile Visualforce page(s). Users will then be able to access your mobile web application without having to authenticate with




As far as I understand, that's the approach from the article I mentioned before.
Sorry, why do I even need to use any Visualforce pages? I just want to use the API from my existing application, which is outside of Salesforce.

Hi IskraDev, 


I do not think it is possible to directly integrate an external app to access salesforce data. 

Try hard coding a dummy user or a guest user login details in to the App - when it loads in the background it should get authenticated by Salesforce internally and allow the user to access the Salesforce data on the App.