Every Enterprise, Unlimited and Performance Edition org is provisioned with five Salesforce Integration user licenses at no extra cost. Developer Edition gets one. Most teams never find out, and run their integrations on a full Salesforce licence belonging to an admin who left eighteen months ago.
The Integration user licence exists precisely to stop that. It makes available the Minimum Access API Only Integrations profile and the Salesforce API Integration permission set licence, and it produces a user that cannot log into the user interface at all.
What the licence actually gives you
| Salesforce Integration user | A full Salesforce user | |
|---|---|---|
| Cost | Five included free on Enterprise, Unlimited and Performance | Paid seat |
| Can log into the UI | No | Yes |
| API access | REST, SOAP and Bulk API | Yes, plus the UI |
| Profile it enables | Minimum Access API Only Integrations | Any |
| Permission set licence | Salesforce API Integration | Not applicable |
| Starting permissions | Effectively none, granted deliberately | Whatever the profile carries |
The API Only restriction is the load-bearing part. The user can only access Salesforce through the REST, SOAP or Bulk API and not through a user interface. Both the API Enabled and API Only user permissions are set to true and are not editable, so this is a property of the licence rather than a setting somebody can quietly change later.
Why the free-licence detail matters more than it sounds
An integration running as a human's account creates four separate problems, and they tend to arrive together.
It breaks when the person leaves. Deactivating a departing employee takes down production. This is the most common way an integration dies, and the outage arrives on a day nobody has connected to the deactivation.
Attribution disappears. Every record the integration touches shows a person's name in Last Modified By, so audit trails describe activity that person never performed.
Permissions are wrong in both directions at once. The integration inherits everything the human could see, which is more than it needs, and loses whatever the human could not, which is sometimes exactly what it needs.
Costs a seat. The licence you are consuming is one you could have given to someone who logs in.
Five free licences is enough for most orgs to give each integration its own identity. Separate users mean you can revoke one integration without touching the others, and the Last Modified By value tells you which system made a change.
Setting one up
The order matters, because the profile is deliberately empty.
- Create the user with the Salesforce Integration user licence and the Minimum Access API Only Integrations profile.
- Build a dedicated permission set for that integration and grant only the objects and fields it needs. Not a copy of an existing set, and not System Administrator.
- Assign the Salesforce API Integration permission set licence alongside it. The permission set licence is what makes the integration permissions assignable.
- Grant field-level security explicitly. Object access without field access produces confusing partial failures rather than clean errors.
- Restrict by IP or use a login policy appropriate to where the integration actually connects from.
- Name it for the system, not the person.
NetSuite Synctells the next admin what breaks if they deactivate it.
Start from nothing and add what fails. Starting from a broad profile and removing permissions produces an integration that works and nobody can safely tighten later.
Where the licence does not help
Three things the Integration user licence will not do, worth knowing before you plan around it.
It does not raise your API allocation. API request allocations are calculated per org from edition and licence counts. An Integration user does not add headroom, and a busy integration on a small org still hits the same ceiling. Our guide to Salesforce API rate limits covers how that number is derived.
It does not replace OAuth. The user is the identity your integration acts as. The OAuth app is how it authenticates. On Salesforce that app is now an external client app, since connected app creation through the UI was turned off by default on new orgs in Winter '26 and re-enabling it has required Salesforce Support since Spring '26.
It does not exist inside a customer's org because you shipped it. If you distribute a managed package, the customer provisions and configures their own integration user. What you can do is document exactly which permissions your app needs, which is a meaningful part of what makes an app easy to install.
If you need more than five
Additional licences are available through your Salesforce account executive. Before buying, check whether you actually need more identities or just better hygiene, since orgs that have run out of five have usually accumulated integrations that no longer run.
Two per-integration users are worth the split when the two systems have genuinely different permission needs, or when you want to be able to revoke one without auditing the other. Beyond that, splitting further mostly adds administration.
Frequently Asked Questions
Is the Salesforce Integration user license free?
Enterprise, Unlimited and Performance Edition orgs are automatically provisioned with five Salesforce Integration user licences at no additional cost, and Developer Edition orgs are provisioned with one. Additional licences are purchased through your Salesforce account executive.
What is an API Only user in Salesforce?
A user who can access Salesforce only through the REST, SOAP or Bulk API, never through the user interface. On the Salesforce Integration user licence, the API Enabled and API Only user permissions are both set to true and are not editable, so the restriction cannot be removed by changing a setting.
What profile does the Salesforce Integration user license use?
It makes the Minimum Access API Only Integrations profile available, along with the Salesforce API Integration permission set licence. The profile grants almost nothing by design, so object and field access is added through a permission set built for that specific integration.
Can an integration user log into Salesforce?
Not through the user interface. That is the point of the licence. It authenticates through the API only, which means a stolen credential cannot be used to browse the org, and it removes an entire class of accidental interactive access.
Does an integration user increase my API limits?
No. API request allocations are calculated at org level from your edition and licence counts. Adding an Integration user gives the integration its own identity and permission scope, not additional API headroom.
Should each integration have its own user?
Yes where you can. Separate users let you revoke one integration without affecting others, and they make Last Modified By meaningful, so a record change points at the system that made it. Five free licences on Enterprise Edition and above is enough for most orgs to do this.
What happens if I run an integration as an admin user?
It works until that person is deactivated, at which point production stops. The integration also inherits far more access than it needs and attributes every change it makes to a real person, which makes audit trails describe activity that person never performed.
Related Articles
- Salesforce API rate limits and native integration advantages
- What is an external client app in Salesforce
- Salesforce user management REST API documentation
- Salesforce integration patterns and best practices
Sources
- Salesforce Help, Assign the New Salesforce Integration User License: five licences on Enterprise, Unlimited and Performance, one on Developer Edition, Minimum Access API Only Integrations profile, Salesforce API Integration permission set licence. 2/ Salesforce Help, Give Integration Users API Only Access: API Enabled and API Only permissions set to true and not editable. 3/ Salesforce Admins, Best Practices for Configuring Your Integration User. 4/ Salesforce Help, External Client Apps and connected app creation changes. Verified 2 September 2026.
