I have read the Salesforce documentation about username/password authentication here:


and it seems that defining a connected app is mandatory as well as including the secret and its key in the headers of the http request. It appears however that some libraries, such as https://pypi.python.org/pypi/simple-salesforce are not requiring a connected-app for the username-password oauth flow.

How is this possible?

1 Answer 1


I just yesterday implemented a little Python app using simple-salesforce! As it turns out, simple-salesforce is actually using the SOAP login() call for authentication, but provides an api middleware layer for REST.

I figured that SOAP login thing out out when I was reviewing the code in the login.py method in the simple-salesforce repo That's totally the SOAP endpoint on line 47 there...

Generally speaking, REST integrations use OAuth2.0 for authentication, but it's not carved in stone.

  • +1 As you've observed, OAuth access tokens and SOAP login sessions are roughly analogous, and you can interchange them freely as long as they are API-enabled (for example, Lightning sessions don't work because they are API-restricted).
    – sfdcfox
    Apr 24, 2017 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.