I am trying to get the access token over a controller that is connected to a Salesforce site. But I am having the below error message:

System.CalloutException: Unauthorized endpoint, please check Setup->Security->Remote site settings. endpoint = https://sandbox-goku.cs87.force.com/services/oauth2/token

My controller:

 public class Mycontroller {
        public String accessToken {
            private set;
            get {
                if (accessToken == null) {
                    accessToken = RestUtil.getAccessToken();

                return accessToken;

Utility to get the access token:

public class RestUtil {
    private transient static String accessToken = '';

    public static String getAccessToken() {
        if (accessToken == '') {
            accessToken = fetchAccessToken();

        return accessToken;

    private static String fetchAccessToken() {
        HttpRequest authReq = buildAutHttpRequest();

        Http http = new Http();

        HttpResponse authRes = http.send(authReq);

        String accessToken = extractAccessToken(authRes);

        return accessToken;

    private static String extractAccessToken(HttpResponse authRes) {
        Map<String, Object> authResult = (Map<String, Object>) JSON.deserializeUntyped(authRes.getBody());

        return (String) authResult.get('access_token');

    private static HttpRequest buildAutHttpRequest() {
        HttpRequest authReq = new HttpRequest();
        authReq.setEndpoint('https://' + URL.getSalesforceBaseUrl().getHost() + '/services/oauth2/token');

        return authReq;

    private static String buildAuthRequestBody() {
        String template = 'grant_type=password&username={0}&password={1}&client_id={2}&client_secret={3}';
        String[] arguments = new String[]{

        return String.format(template, arguments);
  • Did you even attempt to do a search on the error? It would have taken you less time to do that and fix than post the question. The error even specifically tells you what to do
    – Eric
    Commented Aug 17, 2017 at 17:35
  • -1 for not reading the error from me
    – glls
    Commented Aug 17, 2017 at 17:36
  • @glls - Not sure what you are trying to say with your comment?
    – Eric
    Commented Aug 17, 2017 at 17:38
  • I have just attempted to run my method to get the access token and it is working in "Anonymous Apex". Commented Aug 17, 2017 at 17:41
  • 1
    @Cubancoffee - You are not correct. I have implemented many a API/oAuth implementation from sites pages. Give this a try: partial-appfrontier.cs19.force.com/GrantSupportAccess. In your link it specifies only within apex code which is allowed. You cannot do it from the page itself (Client side) using JS
    – Eric
    Commented Aug 17, 2017 at 17:53

1 Answer 1


The problem here is that you're hitting another endpoint via REST and, when you do that, SFDC wants you to whitelist that domain, even if it points back to another SFDC server.

Follow the directions, go to

Setup->Security->Remote Site Settings

and enter the domain


You should then be able to call out

  • 1
    hehe, you beat me to it =P
    – glls
    Commented Aug 17, 2017 at 17:36

Not the answer you're looking for? Browse other questions tagged .