Securing Salesforce Integrations with Heroku AppLink

Summary

Salesforce integrations commonly use Connected Apps or External Services, but long-lived OAuth tokens and public vendor endpoints can expose org data to replay and misuse. Heroku AppLink provides a managed bridge in which a service mesh admits requests only from explicitly connected Salesforce orgs, validates context, and exposes services as native Salesforce actions. For calls back to Salesforce, its SDK obtains short-lived, scoped credentials at runtime through user, user-plus, or authorized-user modes, avoiding refresh-token storage in vendor systems. The mesh uses the x-client-context header to convey org and user information, while the SDK keeps bearer credentials out of application code. The post describes setup commands for the AppLink add-on, service-mesh buildpack, External Service publication, and authorizations, concluding that AppLink improves governance, least privilege, and replay resistance.

Takeaways

1. 1

   The AppLink mesh allows traffic only from explicitly connected Salesforce orgs and validates each request before it reaches the deployed service.

2. 2

   User and user-plus modes obtain short-lived credentials at runtime; authorized-user mode uses a customer-controlled authorization for a named integration user rather than a vendor-held refresh-token cache.

3. 3

   AppLink supports inbound External Service setup through a Heroku add-on and service-mesh buildpack, followed by API-spec publication and permission-set assignment.