The end user of a Heroku app authorizes Heroku Connect via OAuth.

OAuth provides Heroku Connect with API tokens after the user authorizes the Heroku Connect application on Salesforce

SAML authorizes Heroku Connect to make API calls

A single integration user's credentials are stored.