Tython

Category

Integrations

Connected apps, OAuth flows, and secure Salesforce integration patterns.

security · integrations · ai · apex · salesforce

Your Salesforce Org Needs a Bouncer: How OAuth Token Exchange Checks IDs at the Door

Secure your Salesforce Org by implementing the OAuth 2.0 Token Exchange flow, a programmatic 'bouncer' that validates IDs at the door for external integrations. This zero-trust approach utilizes an external Identity Provider (IdP) for authentication and a custom Apex handler for granular, scoped authorization in Salesforce. Token Exchange is essential for securing modern Agentic AI workflows that chain Salesforce into complex, multi-system processes.

Scott Covert ·

salesforce · security · integrations

The JWT OAuth Flow: The Gold Standard for Salesforce Server-to-Server Integrations

Integrating a vendor into your Salesforce org shouldn't mean handing over a 'blank check' to your data. 🔐 If your server-to-server integrations are still relying on session IDs or long-lived refresh tokens, you’re carrying unnecessary risk. These methods are common targets for session hijacking and supply-chain attacks. The gold standard? The JWT Bearer OAuth Flow. Check out our latest deep dive on why it’s time to kill the refresh token.

Scott Covert ·

salesforce · security · integrations

Vishing: How the wolf gets invited into the Salesforce hen house

This post deconstructs how attackers use vishing and OAuth device flows to trick Salesforce admins into granting permanent API access. By posing as support and using a simple verification code, hackers bypass MFA and establish persistent backdoors that remain active even after password resets. To defend the org, admins should implement architectural controls like API Access Control, Transaction Security Policies, and IP Restrictions.

Scott Covert ·

← Back to all posts