We have an app that is designed to run on a Heroku server that is creating new records in salesforce and also listening to streaming API topics to update our other datastore with changes in those records. We have been using the nforce library with node.js and its been running just fine since late November with no log-in issues to speak of. Either late Friday or Saturday we were updated in sandbox to Spring 16 release and since then am getting an error:

Error: invalid_grant - authentication failure

I have refreshed the user security token and tried that with no success. We did move the app to point at production versus sandbox and had zero issues logging in and creating/monitoring records.

Does anyone know if Salesforce has changed anything in regards to the username/password Auth flow that we need to handle differently? We even tried writing a new app that was just a log-in into the system and that fails the same way. Appears to be an with the upgrade over the weekend.

  • 1
    Spring 16 is the current release going out to sandboxes. Do you mean that rather than Winter 16? Jan 10, 2016 at 23:13
  • Is there anything appearing the the Login History in Salesforce? Jan 11, 2016 at 2:00
  • Sorry, yes Spring 16. The login history shows invalid password but the password has not changed, I am logging into the system using the same password that the application is using so password seems to be working fine
    – Matt Bush
    Jan 11, 2016 at 2:31

1 Answer 1


While testing this morning I discovered that if I removed the personal security token from the credentials object I was passing during authentication I am now able to log straight into Salesforce sandbox and create and process records with my app. Spring 16 must change something in the flow but in reading the release notes I do not see any changes that were made to the flow. You can see below where I commented out the security token from the credential object

var sfCredentials = {username: username , password: password} //, securityToken: personalSecurityToken};

org.authenticate(sfCredentials, function(err, res){....

One thing that we had to do to make this work was to relax IP restrictions with second factor. Also works with Relaxed IP restrictions.

Hopefully someone can determine exactly why this is failing but for now this is a workaround to keep us in development mode.

  • Maybe try regenerating the security token? Jan 11, 2016 at 18:42
  • 1
    We've tried that, did not do anything. The only thing that has worked since the upgrade is the above workaround. We did switch the app over to production which is still on Winter 16 and it worked just fine once the parameters for the connected app were updated to production as well as the security token
    – Matt Bush
    Jan 11, 2016 at 19:22
  • 1
    Doh, I see you already mentioned refreshing the token in the question. It does sound like a bug in Spring 16. Do you have access to premium support? It would be good to raise this as a bug with Salesforce. Jan 11, 2016 at 19:25
  • Cross reference to developer forum post: Spring 16 Upgrade broke username/password OAuth flow Jan 12, 2016 at 20:21
  • 1
    Salesforce has resolved the issue, we are now able to login using the personal security token with IP restrictions turned back on in the connected app
    – Matt Bush
    Jan 20, 2016 at 14:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .