IntegrationAdvancedjwtoauthconnected-app
Design JWT bearer OAuth flow for machine-to-machine Salesforce API access
Real World Scenario
Kubernetes microservices need Salesforce API access without storing refresh tokens; security mandates certificate-based headless authentication.
Expected Answer
• Connected app configured for JWT bearer flow with X.509 certificate uploaded
• Service signs JWT with iss sub aud exp claims; exchanges for access token
• Dedicated integration user with minimum permission set per microservice
• Certificate rotation dual-key period before revoking old cert
• Separate connected apps per service for blast radius isolation
• Token cache in memory with expiry refresh 5 minutes before TTL
• Audit ApiEvent for anomalous JWT client usage patterns
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. Connected app configured for JWT bearer flow with X.509 certificate uploaded. Service signs JWT with iss sub aud exp claims; exchanges for access token. Pick based on your integration pattern and team capability. JWT bearer eliminates refresh token storage—standard pattern for cloud-native Salesforce consumers. Optimize for scale and operational observability.
Architect Perspective
JWT bearer eliminates refresh token storage—standard pattern for cloud-native Salesforce consumers.