Apex

Apex programming tips, tricks, and deep dives.

security · integrations · ai · apex · salesforce

Your Salesforce Org Needs a Bouncer: How OAuth Token Exchange Checks IDs at the Door

Secure your Salesforce Org by implementing the OAuth 2.0 Token Exchange flow, a programmatic 'bouncer' that validates IDs at the door for external integrations. This zero-trust approach utilizes an external Identity Provider (IdP) for authentication and a custom Apex handler for granular, scoped authorization in Salesforce. Token Exchange is essential for securing modern Agentic AI workflows that chain Salesforce into complex, multi-system processes.

Scott Covert ·May 29, 2026

apex · security

Apex Just Got Secure by Default. Is Your Code Ready?

Salesforce is introducing a major shift in Apex security defaults with API v67, moving to a 'secure-by-default' model that automatically enforces user permissions and sharing rules. This update removes WITH SECURITY_ENFORCED and defaults undeclared classes to with sharing, requiring developers to review and explicitly update their code to prevent runtime failures.

Scott Covert ·May 15, 2026

apex · security · permissions

Apex Security Anti-Patterns: The Code-Level Risks Hiding in Your Org

This post breaks down the most common code-level vulnerabilities—from SOQL injection and hardcoded secrets to the dangers of undeclared sharing. Learn how to modernize your codebase using WITH USER_MODE, implement Named Credentials, and leverage the Salesforce Code Analyzer to audit your org and close the gaps before they're exploited.

Scott Covert ·March 13, 2026

salesforce · apex

Writing Idempotent Backend Methods in Salesforce

Leverage database locks to create idempotent backend methods in Salesforce

Martin Glauber ·March 29, 2021

← Back to all posts