Linking your Rails App to Salesforce with OAuth 2.0

Linking your Rails App to Salesforce with OAuth 2.0

Salesforce is one of the most widely used Customer Relationship Management (CRM) tools on the web today, and collects valuable data-driven insights for many businesses as they strive for growth. When building tailored software solutions for your business, it’s often a good idea to pull that valuable data you’ve worked so hard to obtain into your application to generate increasingly valuable data tooling.

Creating a Connected App

To connect your app to Salesforce Online, the first thing you need to do is go to and create a developer account. This is required in order to obtain a client ID and client secret, which you will need to securely connect your application to your salesforce account.

The next step is to create a Connected App in your newly-created salesforce account. Search for “App Manager” in the Quick Find search bar in the top left. After you enter the App Manager, you’ll need to click “New Connected App” in the top right.

There are a lot of optional fields here, but you must input your application name and application email. API name will be automatically generated if you don’t choose to specify it.

Under “API (Enable OAuth Settings)”, be sure to check the “Enable Oauth Settings” box, and more input fields will appear. This is where you will need to specify your callback URL and OAuth Scopes.

Callback URL

The callback url is where salesforce will send a response after the OAuth authorization endpoint receives your application’s request. This url can be anything you like but it needs to match a route you create in your rails application. In my application, I set up a salesforce session controller with the callback url going to a “callback” action. The routes looked like this:

Additionally, Salesforce requires the callback URL to be an encrypted link with SSL. I found this article very helpful to set up a local SSL certificate that I could run for development in my local machine.

And consequently, the callback URL I inputted in Salesforce for development purposes was https://localhost:3000/salesforce/sessions/callback, and can be set dynamically in our application using the rails built in url helper: salesforce_session_url.

OAuth Scopes

This will be different for every app, and you need to decide what your application needs. For my purposes, I needed access to basic account info, and to have the ability to pull data from salesforce and add it to my PosgreSQL database. So, I selected:

“Access and Manage your data”

“Access your basic information”

“Perform requests on your behalf at any time”


Now, you can click “Save” and your consumer key and consumer secret will be created by Salesforce and visible in the Connected App details.

For more detailed instructions on setting up a Salesforce Connected App, visit this link.

Getting an Access Token

Now that the Connected App has been created, we can head to our Rails app and build the OAuth 2.0 flow.

First, you need to save your client id and client secret into your app secrets. In config/secrets.yml, make sure you have:

Obviously, you will need to add these keys to your production environment on Heroku (or whichever service you are using) as well.

Next, you can move to your controller to start making http requests to the necessary Salesforce API endpoints which can be viewed here. In my salesforce sessions controller, I created a new OAuth2 Client/Consumer and made a request to the authorization endpoint with the required parameters:

You’ll want to add this link to your view file for the user to initiate the link:

If you start your dev server, go into your browser, and click the link you will be redirected to salesforce login page. Enter your credentials, click login, and you will next be prompted to give your app permission to access your salesforce data. After clicking “Allow”, salesforce will then redirect you back to your callback url, which we set up to be the callback action in our salesforce controller. Salesforce will have sent an authorization code in the response parameters.

Now, in your callback action, you can use that authorization code to obtain an access_token:

Once you have the access token, you are officially linked to salesforce. You will use this token to make requests and fetch your data from your salesforce account. It is up to you where you want to save it, but I would recommend either save it in your rails application cookies or in a SalesforceAccount Model in your database.

Need Help?

Need some help integrating with salesforce in your ruby on rails application?  We would love to hear from you and have the chance to use our expertise crafting quality web applications for your product!

free consultation

Written by Reed Van Anrooy

Software Engineer at Lotus Apps
Find me on:

Subscribe to Email Updates

Web vs Mobile software solutions
Why Should I Brand My Company?