What's the difference between these authentication endpoints?

Question

Based on the information in the Salesforce rest-API documentation, examples of valid restful endpoints for authentication are:

• For authorization: https://login.salesforce.com/services/oauth2/authorize
• For token requests: https://login.salesforce.com/services/oauth2/token

To get a token for our app that is doing OAuth, we're using https://login.salesforce.com/services/oauth2/authorize?display=touch&response_type=token&client_id=myclientid&redirect_url=myredirecturl.

After realizing that there is a specific end point for token getting a token (i.e. /oauth2/token), I'm curious if these two endpoints are the same when passing the query string parameter "response_type=token" to the /authorize endpoint.

Note that my application is working correctly in retrieving the token right now, I'm just curious if I could change the URL to https://login.salesforce.com/services/oauth2/token?display=touch&client_id=myclientid&redirect_url=myredirecturl and have the same result?

Answer 1

The different endpoints are used for different authentication flows, this is all covered in the REST API documentation.

The /authorize endpoint is used for the Web Server OAuth Authentication Flow and User-Agent OAuth Authentication Flow.

The /token endpoint is used for the Username-Password OAuth Authentication Flow and the OAuth Refresh Token Process.

Web Server OAuth Authentication Flow

The Web server authentication flow is used by applications that are hosted on a secure server. A critical aspect of the Web server flow is that the server must be able to protect the consumer secret.

In this flow, the client application requests the authorization server to redirect the user to another web server or resource that authorizes the user and sends the application an authorization code. The application uses the authorization code to request an access token. The following shows the steps for this flow.

---

User-Agent OAuth Authentication Flow

The user-agent authentication flow is used by client applications (consumers) residing in the user’s device. This could be implemented in a browser using a scripting language such as JavaScript, or from a mobile device or a desktop application. These consumers cannot keep the client secret confidential.

In this flow, the client application requests the authorization server to redirect the user to another Web server or resource which is capable of extracting the access token and passing it back to the application. The following shows the steps for this flow.

---

Username-Password OAuth Authentication Flow

The username-password authentication flow can be used to authenticate when the consumer already has the user’s credentials.

In this flow, the user’s credentials are used by the application to request an access token as shown in the following steps.

Warning
This OAuth authentication flow involves passing the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token will be issued.

---

OAuth Refresh Token Process

The Web server OAuth authentication flow and user-agent flow both provide a refresh token that can be used to obtain a new access token.

Access tokens have a limited lifetime specified by the session timeout in Salesforce. If an application uses an expired access token, a “Session expired or invalid” error is returned. If the application is using the Web server or user-agent OAuth authentication flows, a refresh token may be provided during authorization that can be used to get a new access token.

Answer 2

You use /services/oauth2/authorize to log in. The result of the login may be either an access token or authorization code, depending on the grant_type used. In contrast, /services/oauth2/token is used solely to gain a token; you are already logged in when you use this endpoint, and you either need an access token (e.g. grant_type=code was passed to the authorize endpoint), or you need a new access token because the current token has expired and you have a refresh token (i.e. your scope included refresh_token during the authorization step, and that grant_type permits a refresh token, and the client ID has refresh tokens enabled).

Edit: I should mention that the Username-password flow does use the token endpoint, instead of the authorization endpoint, but you should not be using that flow in any production code. It's meant only for debugging/testing.

Answer 3

When we need to authorize the user then we hit : https://login.salesforce.com/services/oauth2/authorize

After hitting the above url the page is redirect to login page and ask to user to allow the application for access based on user. if user allow this the page response by giving some parameter. Code is one of them parameter.

By the value of code parameter we make a post request with this endpoint " https://login.salesforce.com/services/oauth2/token" with code parameter and access_token, based on this access_Token we can access the things.