Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
Elements of User Authentication
Configure User Authentication
Restrict Where and When Users Can Log In to Salesforce
Set Password Policies
Expire Passwords for All Users
Modify Session Security Settings
Define Identity Verification Settings for Your Orgs and Experience Cloud Sites
Require High-Assurance Session Security for Sensitive Operations
Custom Login Flows
Set Up a Login Flow and Connect to Profiles
Login Flow Examples
Multi-Factor Authentication Customizations
Enable MFA with Session Security Levels
Set Multi-Factor Authentication Login Requirements for API Access
Connect Salesforce Authenticator to a Salesforce Account for Identity Verification
Verify Your Identity with a TOTP Authenticator App
Disconnect Salesforce Authenticator from a User’s Account
Disconnect a User’s TOTP Authenticator App
Generate a Temporary Identity Verification Code
Expire a Temporary Verification Code
Implement Multi-Factor Authentication with Apex
Delegate Multi-Factor Authentication Management Tasks
Deploy Third-Party, SMS-Based Multi-Factor Authentication
Limit the Number of Concurrent Sessions with Login Flows
Connected Apps
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data's Security with Shield Platform Encryption
Monitoring Your Organization’s Security
Real-Time Event Monitoring
Security Guidelines for Apex and Visualforce Development
API End-of-Life
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Set Multi-Factor Authentication Login Requirements for API Access

You can require multi-factor authentication (MFA) for API access using the Multi-Factor Authentication for API Logins permission. With this permission enabled, users are required to complete a second authentication challenge to access Salesforce APIs. API access includes the use of client applications such as the Data Loader and connected apps.
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: Essentials, Contact Manager, Database.com, Developer, Enterprise, Group, Performance, Professional, and Unlimited Editions

User Permissions Needed
To edit system permissions in profiles: Manage Profiles and Permission Sets
To enable this feature: Multi-Factor Authentication for User Interface Logins

MFA was formerly called two-factor authentication or 2FA.

Note

The Multi-Factor Authentication for User Interface Logins permission is a prerequisite for the Multi-Factor Authentication for API Logins permission. Users with these permissions must complete MFA when they log in to Salesforce through the UI. Users with mobile devices can use the Salesforce Authenticator mobile app or a third-party authenticator app as a verification method for MFA. Then they can use verification codes (time-based one-time passwords, or TOTP) from the app to complete MFA.

For developer tools that use API logins, users log in with a security token or TOTP instead of Salesforce Authenticator when MFA is enabled.

API Only users can access the UI to register for MFA only. After a successful registration, API Only users can no longer access the UI.

Note

For connected apps, only the OAuth 2.0 refresh token flow, web server flow, and user-agent flows support using API logins with the high assurance MFA session security level. All other OAuth flows, such as the JSON Web Token (JWT) bearer token flow, block API logins with the high assurance MFA session security level. It’s possible that users are prompted to verify their identity twice with high assurance MFA during an OAuth approval flow. The first challenge occurs in the UI session. The second challenge happens when the access token is bridged into the UI. This second challenge is triggered because the high assurance MFA session security level isn’t transferred to the access token. For more information, see Session Security Levels and Enable MFA with Session Security Levels.