---
title: "Securing Salesforce Integrations with Heroku AppLink"
description: "Salesforce integrations commonly use Connected Apps or External Services, but long-lived OAuth tokens and public vendor endpoints can expose org data to replay and misuse. Heroku AppLink provides a managed bridge in which a service mesh admits requests only from explicitly connected Salesforce orgs, validates context, and exposes services as native Salesforce actions. For calls back to Salesforce, its SDK obtains short-lived, scoped credentials at runtime through user, user-plus, or authorized-user modes, avoiding refresh-token storage in vendor systems. The mesh uses the x-client-context header to convey org and user information, while the SDK keeps bearer credentials out of application code. The post describes setup commands for the AppLink add-on, service-mesh buildpack, External Service publication, and authorizations, concluding that AppLink improves governance, least privilege, and replay resistance."
---

# Securing Salesforce Integrations with Heroku AppLink

[Heroku](https://yomu.fyi/company/heroku) · David Baliles · Sep 10, 2025

**Type:** Explainer

## Summary

Salesforce integrations commonly use Connected Apps or External Services, but long-lived OAuth tokens and public vendor endpoints can expose org data to replay and misuse. Heroku AppLink provides a managed bridge in which a service mesh admits requests only from explicitly connected Salesforce orgs, validates context, and exposes services as native Salesforce actions. For calls back to Salesforce, its SDK obtains short-lived, scoped credentials at runtime through user, user-plus, or authorized-user modes, avoiding refresh-token storage in vendor systems. The mesh uses the x-client-context header to convey org and user information, while the SDK keeps bearer credentials out of application code. The post describes setup commands for the AppLink add-on, service-mesh buildpack, External Service publication, and authorizations, concluding that AppLink improves governance, least privilege, and replay resistance.

## Context

Connected Apps may require vendors or custom code to store long-lived OAuth tokens, while External Services traditionally depend on vendor-managed endpoints and security. The post identifies token replay, broad API access, data export, and insufficient trust boundaries as risks when credentials or endpoints are compromised.

## Approach / What changed

Heroku AppLink places a service mesh in front of Heroku-deployed services, restricts inbound traffic to connected Salesforce orgs, validates request context, and obtains short-lived credentials for outbound Salesforce calls. It supports user, user-plus, and authorized-user modes, API Catalog publication, and managed authorizations.

## Takeaways

- The AppLink mesh allows traffic only from explicitly connected Salesforce orgs and validates each request before it reaches the deployed service.
- User and user-plus modes obtain short-lived credentials at runtime; authorized-user mode uses a customer-controlled authorization for a named integration user rather than a vendor-held refresh-token cache.
- AppLink supports inbound External Service setup through a Heroku add-on and service-mesh buildpack, followed by API-spec publication and permission-set assignment.

**Tags:** [Heroku](https://yomu.fyi/topic/heroku), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [Salesforce](https://yomu.fyi/topic/salesforce), [Security](https://yomu.fyi/topic/security)

- Source: [Heroku](https://www.heroku.com/blog/securing-salesforce-integrations-with-heroku-applink)
- Source URL: https://www.heroku.com/blog/securing-salesforce-integrations-with-heroku-applink
- Ingested by Yomu: 2026-09-10T04:04:52.218Z

[Read original post](https://www.heroku.com/blog/securing-salesforce-integrations-with-heroku-applink)