I am a novice in salesforce. I have access to multiple sandbox instances of salesforce. I am trying to do an OAuth2.0 authentication and call some rest api. But when I request for the token, in the response I am not getting the desired instance url. Any idea how to get the desired instance url?

Because that instance url will be the url for further rest api call that I want to perform.

I am using https://test.salesforce.com/services/oauth2/token to get the token.

  • can you share your request and response ? url is perfectly fine to get the token
    – Himanshu
    Commented Feb 15, 2016 at 18:28
  • Request headers-- grant_type- password, client_id-<client id>, client_secret-<client secret>, username-<username>, password-<password> Response-- { "access_token": "xxxxxxxxxxxxxxxxxxxxxxxxe2q!ARYAQKpJKX2dfesHR_yw1jXXRYL7X4fgtr8b_qtwllypRu5omxxxxxxxrtrhmWSXlHDAt4DasU99KWIvewtwtewY3ZNm_je7I5kQT3r_1sp", "instance_url": "abc.my.salesforce.com", "id": "test.salesforce.com/id/xxxxxxxxxxxxxxxxxx/yyyyyyyyyyyyyy", "token_type": "Bearer", "issued_at": "1455558743915", "signature": "xxxxxxxxxxxxxxxxxxxx" }
    – hardcoder
    Commented Feb 16, 2016 at 4:43
  • above is the resquest and response. Obviously I messed up the actual values before posting.
    – hardcoder
    Commented Feb 16, 2016 at 4:44

2 Answers 2


You can call out to your own org's OAuth endpoints in the same way that you call out to the endpoints at test.salesforce.com and login.salesforce.com to get an access token. These are all valid endpoints and behave the same way:

Whichever endpoint you call out to will return the FQDN of the org as the instance_url value in the return payload. Since client IDs and secrets are unique across all orgs, you can call out your custom domain and login/test (depending on if your instance is a Production or Sandbox instance)

The only major consideration is for Government Cloud customers, who cannot reach their orgs through the generic login URLs and must use their custom domains.


Client ID and Client secret is unique per organization so every org has its own Client ID and Client secret. Once you send your details to auth endpoint it will verify your credential with that org only and it will return access_token which is valid only for that org. You will pass that access_token in your futher call in header. It doesn't matter if you share same instace_url between two organization.

Rest API call will work in following way.

  1. Callout to Auth end point https://test.salesforce.com/services/oauth2/token with client_id and client_secret
  2. Response will contain access_token and instance url
  3. Set header as Authorization Bearer: Acces_token (generated in step 2)
  4. Make call to instance_url.

Reference tutorial

  • 1
    This is not correct as I read it. Client id and secret are unique to the connected app. The app only exists in a single org. The oAuth is done against any org authorizing said app to access.
    – Eric
    Commented Jun 2, 2019 at 22:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .