Are all of these three separate values that are only linked for the same user ? For security token I mean on value that you can take from Setup -> My Personal Information -> Reset security token.

As I know session id and access token are different values. Which relationship has security token ?

2 Answers 2


A session ID identifies a user using the UI or an API/integration tool. It has a set time to live and may be manually expired by explicitly logging out. It may also be tied to a specific IP address, if configured. Session ID values are valid across all APIs, including SOAP and REST endpoints.

Access Tokens are used by Connected Apps and other OAuth-enabled apps (such as Chatter Mobile). These tokens also have a similar life span, but can also be refreshed with a Refresh Token if granted permission. This allows services to have long-lived connections to the user account, even if they log out of other devices. Like session IDs, you can use access tokens anywhere a session ID is valid.

Security Tokens are the only type of token a user actually needs to "remember". A security token grants access to the user's account from outside of their normal domain. This token is only necessary if the user's current IP address is not whitelisted, and will not allow users to access salesforce.com outside of their IP restrictions or login times. The token is always provided as part of the password: passwordtoken. There is no intervening space or other symbol that separates the two.

  • 4
    You can use an access token with the SOAP API. You just pass it where you'd normally pass the sessionId.
    – superfell
    Oct 22, 2013 at 14:27

As I know:

Session Id: SessionId is obtaines when use login from web interface or does a soap api call. A session is bind by user login time and activity and expires after if user remain idle for specific time.

AccessToken: Access token is a part of standard OAuth flow. It allows to do operation on behalf of user which authorize a connected app or other apps according to permission defined. A time specific token work on behalf of user. It get expire after a period of time. Default is 3600 seconds. In case of Salesforce it is obtained according to OAuth 2.0 specifications. Unlike sessionid, accesstoken expires after a fixed time period.

Security token: Security token is an addition to user's password which allow access to organization without IP restrictions. A request made from white listed IP never requires security token but other requires. Relationship of security token with access token or session id is that, when request is made from non-whitelisted IP then security token need to append with user's passwork e.g; myPassword+mySecurityToken in request otherwise only password need to send for authorization and recieving access token or session id.

  • 1
    How we can utilize the SessionId to access a REST class? What are the possible steps we need to take on Salesforce side to make our REST class available to the script which has the SessionId (get with SOAP login).
    – Superman
    Jan 19, 2017 at 6:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .