I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through BASIC Authorization.

I was caching this token but would run into an error on the second time I tried to use it. As it turns out, this token can only passed into an API call ONCE. The next API call need to retrieve its own token. Basically this results in two API calls for every one API operation. Salesforce limits the number of callouts you can make per execution context, so this is really not ideal.

I'm wondering if there is any logical reason for doing it this way? Wouldn't just using BASIC Authorization in each operation be just as secure (or un-secure)?

  • Do you retrieve the token via the API as well?
    – cpast
    Commented May 14, 2015 at 19:01
  • @cpast yes, its a different soap endpoint, but basically the same service.
    – NSjonas
    Commented May 14, 2015 at 19:16

1 Answer 1


Generally, one time use tokens are used to mitigate replay attacks and to make it harder to steal authentication information. They have other uses in protocol design for multi-tentant and multi-user systems. I am going to assume those don't apply because you said this was a custom API built just for you.

If you are calling the API over the web using SSL/TLS then TLS/SSL already provides mitigation against replay. It also provides encryption to help mitigate someone stealing your authentication information. I would say they have over-designed the security in the API. However real security is about layers and adding another layer makes it more secure. How much more secure versus the cost of the second call is debatable. You might suggest they issue you a time limited token vs a one time token.

That being said there is no limit to the number of Apex callouts from Salesforce. There is only a limit to the number of callouts per transaction. See here and here

  • Thanks, I had already suggested making the token time based.
    – NSjonas
    Commented May 14, 2015 at 19:07
  • Also, I understand how the limits work. An "Execution Context" is the same thing as a transaction in salesforce.
    – NSjonas
    Commented May 14, 2015 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .