Loading
Salesforce now sends email only from verified domains. Read More
Identify Your Users and Manage Access
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Restrict Customers and Partners from Accessing APIs

            You are here:

            1. Salesforce Help
            2. Docs
            3. Identify Your Users and Manage Access

            Restrict Customers and Partners from Accessing APIs

            You can use API Access Control to restrict customers and partners from accessing APIs, unless they’re using a connected app that is installed in the Experience Cloud site. Connected apps integrate external applications with Salesforce APIs. You can select which connected apps to install in the Experience Cloud site to limit access to APIs.

            Required Editions

            Available in: both Salesforce Classic and Lightning Experience
            Available in: Professional, Enterprise, Performance, Unlimited, and Developer Editions
            User Permissions Needed
            To read, create, update, or delete connected apps:

            Customize Application AND either

            Modify All Data OR Manage Connected Apps
            To update all fields except Profiles, Permission Sets, and Service Provider SAML Attributes:

            Customize Application AND either

            Modify All Data OR Manage Connected Apps
            To update Profiles, Permission Sets, and Service Provider SAML Attributes: Customize Application AND Modify All Data AND Manage Profiles and Permission Sets
            To rotate the consumer key and consumer secret: Allow consumer key and secret rotation
            To install and uninstall connected apps:

            Customize Application AND either

            Modify All Data OR Manage Connected Apps
            To install and uninstall packaged connected apps:

            Download AppExchange Packages AND Customize Application AND either

            Modify All Data OR Manage Connected Apps

            To enable this feature, request API Access Control from Salesforce Customer Support.

            After enabling this limitation, you can further define which users can access a connected app through the OAuth Permitted Users policy. See Manage OAuth Access Policies for a Connected App.

            Important
            Important If users have the Use Any API Client permission, they can access any app, including all connected apps. Use this permission with extreme caution. It’s only intended for a limited number of admins.
            1. From Setup, in the Quick Find box, enter API Access Control, and select API Access Control.
            2. Click Edit, and select For customers and partners, limit API access to only installed connected apps.
              Customers and partners can access Salesforce APIs only if they’re using an installed connected app. Install a connected app on the Connected Apps OAuth Usage page.
            3. To allow users of Visualforce pages to override this limitation and access APIs, select Allow Visualforce pages to access APIs.
              If you don’t select this option, users that access Salesforce APIs through Visualforce are denied access. Also, client apps that call getSessionId() are denied access.
            4. Save your changes.
              Note
              Note If you allowlist connected apps in your org and don’t receive the expected scopes, take these steps:
              • From Setup, in the Quick Find box, enter OAuth, then select Connected Apps OAuth Usage.
              • For the allowlisted connected app, click Block.
              • For the allowlisted connected app, click Unblock.

            Grant Customers and Partners Access to Uninstalled or Blocked Connected Apps

            After enabling this API Access Control restriction, you can grant customers and partners access to connected apps that are uninstalled or blocked. Org users can still access connected apps that are uninstalled.

            1. From Setup, in the Quick Find box, enter Connected Apps, and select Connected Apps OAuth Usage.
            2. Under Actions
              • Click Install if the connected app isn’t installed.
              • Click Unblock to allow users to access the connected app.
             
            Loading
            Salesforce Help | Article