I tried this out in a developer edition org.
- Confirm Visualforce page URL by directly accessing URL: https://thepackage-dev-ed--abc.na62.visual.force.com/apex/samplePage. Note that I have a namespace prefix defined in this org in addition to a "My Domain" of thepackage-dev-ed
- Tested in an anonymous Chrome window with no URL parameters. Redirected to login page as expected.
- Tested in an anonymous Chrome window with
?oauth_token=<Session ID from sid cookie>
. Visualforce page displayed
- Tested in an anonymous Chrome windows with
?oauth_token=<Session ID from sid cookie in force.com domain>
. Redirected to login page. Expected as the session id from that context is limited.
- Tested in an anonymous Chrome windows with
?oauth_token=<access_token form OAuth connected app with full scope>
. Worked.
So, double check if the Visualforce page URL requires the My Domain changes. Also try with some different classes of Session ID to narrow down if it is just the access_token causing the problem.
To reproduce case 3:
- open Salesforce to /home/home.jsp.
- Bring up the Chrome Developer tools
- Application tab
- Find Cookies under storage
- Copy the session ID out of the
sid
cookie. Either the one that is bound to your domain (e.g. na64) or the my domain one.

Revisited
- Got a session ID from the SOAP API so I'd have no active browser based Salesforce login.
- Tried browsing to https://thepackage-dev-ed--abc.na62.visual.force.com/apex/samplePage - Got redirect to the login page.
- Tried browsing to https://thepackage-dev-ed--abc.na62.visual.force.com/apex/samplePage?oauth_token= - Visualforce page displayed directly. Note any attempt to load a different page came up with the login page.
- Tried the URL from (3) in Firefox, got bounced around and auto logged out.
- Tried the URL from (3) in Edge, got bounced around and auto logged out.
- Cleared the cookies from Chrome. Got the same results as Firefox and Edge.
So there is some extra cookie that is required in the process.
There were a number of cookies from login.salesforce.com
and thepackage-dev-ed--abc.na62.visual.force.com
that might have been at play here.
I believe it is one of the non-session persisted visual.force.com cookies that is important here. Try:
- Logging into Salesforce.
- Viewing the Visualforce page (sets the required cookies)
- Logging out of Salesforce
- Accessing the Visualforce page with the
oauth_token
URL param and otherwise no active browser session.
I found this works. Isolating which of those cookies is required would take some laborious trial and error.