---
title: "Mastering API Gateway Integration: Salesforce, Heroku, and MuleSoft Anypoint Flex Gateway"
description: "MuleSoft Anypoint Flex Gateway provides a pattern for exposing APIs and microservices running in Heroku Private Spaces while adding API management and security controls. The tutorial deploys an internal Heroku application, creates or imports an OpenAPI 3.0 specification in Anypoint Design Center, publishes it to Exchange, registers the gateway through Runtime Manager, and deploys it in the same Private Space. That placement lets internal-routing applications receive public traffic through the gateway while routing access through a centrally configured layer managed with MuleSoft and Heroku. It then applies a Client ID Enforcement policy in API Manager, showing that requests with incorrect credentials fail and requests using the issued Client ID and Client Secret can authenticate. The pattern is presented as a foundation for Heroku and Salesforce multi-cloud integrations."
---

# Mastering API Gateway Integration: Salesforce, Heroku, and MuleSoft Anypoint Flex Gateway

[Heroku](https://yomu.fyi/company/heroku) · Julián Duque · Jul 29, 2024

**Type:** Tutorial

## Summary

MuleSoft Anypoint Flex Gateway provides a pattern for exposing APIs and microservices running in Heroku Private Spaces while adding API management and security controls. The tutorial deploys an internal Heroku application, creates or imports an OpenAPI 3.0 specification in Anypoint Design Center, publishes it to Exchange, registers the gateway through Runtime Manager, and deploys it in the same Private Space. That placement lets internal-routing applications receive public traffic through the gateway while routing access through a centrally configured layer managed with MuleSoft and Heroku. It then applies a Client ID Enforcement policy in API Manager, showing that requests with incorrect credentials fail and requests using the issued Client ID and Client Secret can authenticate. The pattern is presented as a foundation for Heroku and Salesforce multi-cloud integrations.

## Context

Companies want to expose APIs and microservices to the internet while improving API security. The example focuses on connecting private APIs hosted in Heroku Private Spaces to external consumers through Flex Gateway, with future Salesforce integration identified as a goal.

## Approach / What changed

Deploy an internal API in a Heroku Private Space, define and publish its OpenAPI specification through Anypoint Design Center and Exchange, register Flex Gateway in Runtime Manager, and deploy it in the same Private Space. API Manager then applies Client ID Enforcement to the exposed API.

## Takeaways

- Flex Gateway is deployed in the same Heroku Private Space as the internal application, allowing the application to receive public traffic through the gateway.
- An OpenAPI 3.0 specification can be imported into Anypoint Design Center, checked with its mocking service, and published to Anypoint Exchange for API management.
- API Manager’s Client ID Enforcement policy rejects requests with incorrect credentials and requires the issued Client ID and Client Secret for authenticated access.

**Tags:** [API](https://yomu.fyi/topic/api), [Heroku](https://yomu.fyi/topic/heroku), [Salesforce](https://yomu.fyi/topic/salesforce), [Security](https://yomu.fyi/topic/security)

- Source: [Heroku](https://www.heroku.com/blog/mastering-api-integration-salesforce-heroku-mulesoft-anypoint-flex-gateway)
- Source URL: https://www.heroku.com/blog/mastering-api-integration-salesforce-heroku-mulesoft-anypoint-flex-gateway
- Ingested by Yomu: 2026-09-10T00:03:11.873Z

[Read original post](https://www.heroku.com/blog/mastering-api-integration-salesforce-heroku-mulesoft-anypoint-flex-gateway)