I am trying to get the access token over a controller that is connected to a Salesforce site. But I am having the below error message:

System.CalloutException: Unauthorized endpoint, please check Setup->Security->Remote site settings. endpoint = https://sandbox-goku.cs87.force.com/services/oauth2/token

My controller:

 public class Mycontroller {
        public String accessToken {
            private set;
            get {
                if (accessToken == null) {
                    accessToken = RestUtil.getAccessToken();

                return accessToken;

Utility to get the access token:

public class RestUtil {
    private transient static String accessToken = '';

    public static String getAccessToken() {
        if (accessToken == '') {
            accessToken = fetchAccessToken();

        return accessToken;

    private static String fetchAccessToken() {
        HttpRequest authReq = buildAutHttpRequest();

        Http http = new Http();

        HttpResponse authRes = http.send(authReq);

        String accessToken = extractAccessToken(authRes);

        return accessToken;

    private static String extractAccessToken(HttpResponse authRes) {
        Map<String, Object> authResult = (Map<String, Object>) JSON.deserializeUntyped(authRes.getBody());

        return (String) authResult.get('access_token');

    private static HttpRequest buildAutHttpRequest() {
        HttpRequest authReq = new HttpRequest();
        authReq.setEndpoint('https://' + URL.getSalesforceBaseUrl().getHost() + '/services/oauth2/token');

        return authReq;

    private static String buildAuthRequestBody() {
        String template = 'grant_type=password&username={0}&password={1}&client_id={2}&client_secret={3}';
        String[] arguments = new String[]{

        return String.format(template, arguments);

marked as duplicate by Eric apex Aug 17 '17 at 17:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Did you even attempt to do a search on the error? It would have taken you less time to do that and fix than post the question. The error even specifically tells you what to do – Eric Aug 17 '17 at 17:35
  • -1 for not reading the error from me – glls Aug 17 '17 at 17:36
  • @glls - Not sure what you are trying to say with your comment? – Eric Aug 17 '17 at 17:38
  • I have just attempted to run my method to get the access token and it is working in "Anonymous Apex". – Cuban coffee Aug 17 '17 at 17:41
  • 1
    @Cubancoffee - You are not correct. I have implemented many a API/oAuth implementation from sites pages. Give this a try: partial-appfrontier.cs19.force.com/GrantSupportAccess. In your link it specifies only within apex code which is allowed. You cannot do it from the page itself (Client side) using JS – Eric Aug 17 '17 at 17:53

The problem here is that you're hitting another endpoint via REST and, when you do that, SFDC wants you to whitelist that domain, even if it points back to another SFDC server.

Follow the directions, go to

Setup->Security->Remote Site Settings

and enter the domain


You should then be able to call out

  • 1
    hehe, you beat me to it =P – glls Aug 17 '17 at 17:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.