I want to expose my API to an external system, and I want to authenticate the user by only username and password. I don't want to use username password OAuth flow while authenticating the user. Can we achieve this?

  • 2
    What have you tried? Why don't you want to use the password OAuth flow? Have you looked at the User-Agent OAuth flow? – Derek F Mar 6 '17 at 17:39

You can achieve this with User-Agent OAuth flow. On a very high level, you have to follow these steps to create one.

  1. In your Salesforce Org create your own REST API.
  2. Create a Connected App and note down the ClientID and ClientSecret.
  3. Now to call this REST API you have to first get the access token. To get this token you have to call this URL via POST Method https://login.salesforce.com/services/oauth2/token. Based on the type of org use test.salesforce.com or login.salesforce.com.
  4. Use grant_type=passwordfor User-Agent OAuth flow. So your request body should look like this 'grant_type=password&client_id='+clientId+'&client_secret='+clientSecret+'&username='+username+'&password='+password
  5. You will get a JSON response. Get the access token by parsing the JSON.
  6. Next call your REST API and set this 'Authorization','Bearer ' + accessToken in the Authorization Header.

    And you will get your Response.


It's not REST based, but you can use the SOAP Partner API to establish a valid Session using the Username and Password. You will likely also need to append the Security Token to the end of the Password depending on how the org is setup.

See login()

Not the answer you're looking for? Browse other questions tagged or ask your own question.