Unable to get access_token from salesforce

Question

I'm trying to get a nodeJS RestAPI service in place that should get and post data to and from a Salesforce org.

However I can find a way to get my access_token from Salesforce. I've tried with JsForce, nForce (but since I'm using a Dev Org it can't work),axios but no solutions in sight.

When I tried via Postman and with these info :

grant_type:password
client_id:XXXXXXX
client_secret:XXXXX
username:XXXXX
password:XXXXX(+Security token)

It works like a charm but as soon as I'm using these via Javascript I get:

 { error: 'invalid_grant',
       error_description: 'authentication failure' } } }

I can however use my access_token (the one I got via Postman) to make some get request...

Answer 1

There are several things to check:

1. The most obvious is to make sure that your JS code has the correct values, especially the security token - that one is easy to miss, at least for me. Just yesterday I deployed a Node.js app to EC2 and got the same error; turns out I'd left out the security token, but it had worked locally due to the IP whitelist. Oops.

2. Check your connected app definition (Setup->Create->Apps->Name of app) that you've enabled OAuth and selected the correct scopes - if you're accessing the Rest API, you'll want the "api" scope at a minimum.

3. Check your connected app's OAuth Policy (Setup->Manage Apps->Connected Apps->Name of App). The picklist "Permitted Users" defaults to "All users may self-authorize", which means that anyone in the org can log in via the Connected App, however, the first time a user logs in via the Connected App, they will be presented with a screen to confirm that they wish to allow the Connected App to access Salesforce on their behalf. This won't work with Password auth via JS if the user hasn't already seen and approved this screen for the connected App; this really only works with the User Agent flow.

   If you change "Permitted users" to "Admin approved users are Pre-authorized", then that extra confirmation screen is not shown, however, you must pre-authorize the users. This is probably what you want for a Node.js service. You do this either by profile, or by permission set; in either case, you need to assign the connected app to the profile/perm set. How you do this varies, depending on if you are using the "Enhanced" Profile UI or not (Setup->Customize->User Interfaced->"Enable Enhanced Profile User Interface"). In the "Enhanced" UI, you just select the Profile or Permission set and click the "Assigned Connected Apps" link. Not sure about the old UI, I never use it.

I suspect #3 is your issue. If none of these help, double check your code. Here's some JSForce sample code from an app I'm currently working on:

var jsforce = require('jsforce');
// not shown - config object is loaded from filesystem

var conn = new jsforce.Connection({
  oauth2 : {
    loginUrl : config.org.loginUrl,
    clientId : config.org.clientId,
    clientSecret : config.org.clientSecret
  }
});

conn.login(config.org.username, config.org.password, function(err, userInfo) {
  if (err) { return console.error(err); }
    console.log("User ID: " + userInfo.id);
    console.log("Org ID: " + userInfo.organizationId);
    console.log('Log in complete.');
    // use conn object inside this function to interact with API
  }
});