I created a new connected apps and obtained the Client secret and Id. I am trying to make a login call to another Salesforce org to obtain the access token. Below approach was successful:

String endpoint='https://test.salesforce.com/services/oauth2/token';

String username = 'username';
String password = 'password';
String ClientId= 'abcdefgh';
String ClientSecret = 'xyz234890'; 

Httprequest req = new HttpRequest();    

req.setBody('grant_type=password' + 
      '&client_id=' + ClientId + 
      '&client_secret=' + ClientSecret + 
      '&username=' + username +
      '&password=' + password
Http http = new Http();
HttpResponse res;       

try {
    res = http.send(req);                
}catch(system.CalloutException e){            

In response I get the access token. However I want to try obtaining the access token using named credentials as I do not want to hard code the username,password end points in the apex code. I cam across this article to use Named credentials with OAuth 2 - http://www.jitendrazaa.com/blog/salesforce/salesforce-to-salesforce-integration-using-named-credentials-in-just-5-lines-of-code/ .

Any suggestion whether the above approach would give me the access token in response that I can use in subsequent callouts?

Screen shot of auth provider:

enter image description here

1 Answer 1


As long as the Connected App you're using allows the refresh_token scope, salesforce will explicitly handle your OAuth session, including refreshing expired access tokens. Make sure you specify the correct values in the Scope field when creating the Named Credential. Just follow the directions exactly as specified in the blog post you've linked, and you should be good to go. Note that once you've configured this correctly, there's no need to call /services/oauth2/token, because you'll automatically have your access token maintained for you.

  • Thanks. Does it mean that I do not have to separately request for access token to make subsequent calls? I am trying to access an ApexRest class in another org that is exposed as REST service. If I use the above approach I can directly call the REST service with the named credentials? No need to make two calls(1. One to obtain token 2. to call the rest service)?
    – SfdcBat
    Commented May 30, 2017 at 23:31
  • 2
    @SfdcBat No need to make two calls: just call the service directly. If the access token is expired, it attempts to refresh for you automatically. You can still get exceptions (e.g. if the refresh token is no longer valid), at which point you need to go back to the NC and re-authenticate. In practice, this should happen only rarely, unless the admin of the other org explicitly expires the session.
    – sfdcfox
    Commented May 30, 2017 at 23:46
  • One thing that is concerning me from the steps in the link to create a Authentication provider is where it is mentioned to Create field in User Object. I have many users who will trigger this integration with click of a button. This step in the configuration seems to restrict the integration to only one user. Correct me if my understanding is not right
    – SfdcBat
    Commented May 30, 2017 at 23:56
  • @SfdcBat If you specify Per User, you will have to have each user log in once using a username and password for the remote org. If you used Named Principle, all users will use the same session.
    – sfdcfox
    Commented May 31, 2017 at 0:08
  • I see. I am using Named principle. I did execute the code and I got this error - {"error":"unsupported_grant_type","error_description":"grant type not supported"}. How do I correct this? I did not specify Registration Handler and Execute Registration As in Auth Provider. Will that impact this? added a screen shot of my Auth Provider.
    – SfdcBat
    Commented May 31, 2017 at 0:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .