title: Suggestions for Authenticating between applications (Salesforce ->Heroku)
body: <p>I have been struggling over the past week to get the ideal configuration for my implementation. Basically, I have a Salesforce Page which makes a REST callout containing some data to be computed, A Heroku server then computes this data before sending the computed data back to SF in the response. This all happens in the background and so no Heroku front end exists.</p>
  
  <p>I want to protect this callout with oAuth2, but I'm not sure the best way to do it:</p>
  
  <p>The data itself is not important, its the access to the heroku app which is.</p>
  
  <p>If I use salesforce for authentication, it means that the callout structure doesn't work (I would have to implement a system for Heroku to grab the data from SF before returning it) which isn't ideal and I can't see a way to use Heroku authentication as it allows access to the api but not the app script in a single structure. I think I have to create my own authentication server within Heroku but I'm not exactly sure if this is the correct way of going about it.
  Any tips would be greatly appreciated</p>
  
  <p>This is my callout code from SF:</p>
  
  <pre><code>Http http = new Http();
  HttpRequest request = new HttpRequest();
  //Sets the url to heroku
  request.setEndpoint('My App URL');
  request.setMethod('POST');
  request.setHeader('Content-Type', 'application/json');
  //places the content into the body
  request.setBody(content);
  //Extends the read timeout
  request.setTimeout('120000');
  //Sends the request and waits for a response
  HttpResponse response;
  response = http.send(request);
  </code></pre>
  
  <p>Heroku Side:</p>
  
  <pre><code>    post("/", (req, res) -&gt; {
          //creates a local var for the JSON string
          String data = req.body();
          //--** The server then computes this data and calculates output
          String computedData = compute(data);
          return computedData;
      });
  </code></pre>
  
  <p>I need a way of authenticating this type of connection, Thanks!!!</p>