My web application follows the example in https://github.com/developerforce/Force.com-Toolkit-for-NET/tree/master/samples/WebServerOAuthFlow to initiate a traditional oauth flow. In my application, the user enters their client_id and secret and then initiates the oauth flow which opens a new browser window (window.open()) pointing to Salesforce to start the flow, the following url for example:


What I found is if the client_id was mistyped, the user is given an less than helpful error=invalid_client_id&error_description=client%20identifier%20invalid. I can understand why it doesn't redirect to the redirect_uri since the client_id couldn't be validated. However, I was expecting a pretty Salesforce branded "There was a problem with your client id". As it is, my window is dead and my initiating application has no idea there was a problem.

Am I missing a flag that would ask salesforce to give a pretty error message?

I don't think there's any way from the source web page to know that the window.open() resulted in a 400.

  • Is this a recurring problem? I've encountered this error message before, but once I get login flow configured correctly, it never pops up again. (At least not that I know of).
    – martin
    Feb 24 '17 at 5:37
  • No, not recurring. Again, just happens when the user mistypes something. Usually they copy/paste, but it has happened.
    – Mark Nadig
    Feb 24 '17 at 15:17
  • Why do your users have to type that in anyways? What's stopping you from having your app build that url with the client id and automatically redirecting the users?
    – martin
    Feb 24 '17 at 15:32
  • App does build the url, but the client_id bit is customer specific and each has their own salesforce instance. Usually they copy/paste and no problem. Every other oauth provider (Google, Dropbox, etc.) that I've used gives a prettier error message when something isn't quite right and cannot redirect.
    – Mark Nadig
    Feb 24 '17 at 22:57

Can't you do a GET in javascript (ajax) to this?:


and see the response.

i.e., if text response from http then it's an error otherwise you are good to go so "really" login now.

  • Right, at least make sure it doesn't 400. It may redirect, but that's fine.
    – Mark Nadig
    Feb 24 '17 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.