API only users cannot login and choose 'Reset my security token'. Right now, in my company, we select a System Administrator profile for users, log in for the first time, choose 'Reset my security token', then change the profile to a custom profile which has API only enabled.

The other way of doing it is, modifying the profile to not have API only user checked initially and then turn it on once the security token is received.

Is there a recommend way to do this? Is there an option to force the security token to be sent when the user is created with a profile which has API user enabled?

  • I am unsure what you want here, Are you asking if there is a way to not use security tokens / turn them off? If that is what you are asking yes, you can change your Login IP Range. This will let you Login and do API calls without needing the token. You can also make it so System Admin has API Only turned on when you deploy your code Commented Nov 25, 2013 at 14:49
  • @TimChadwick I'm asking how do I access the 'Reset Security Token' option for users with API Only on their profiles. (That's so much simpler!)
    – LVS
    Commented Nov 27, 2013 at 12:46

5 Answers 5

  1. Use the Log In as Another User feature to log as the API Only user


  1. Reset the security token while logged in as the API Only user


A system administrator for your org can enable this feature through the following steps:

  1. Click Setup
  2. Enter Login Access Policies in the Quick Find box
  3. Select the Administrators Can Log in as Any User checkbox
  4. Click Save


  • Thats neat but also kind of weird. Is the fact that "Login as" works with "API Only" users a feature or a bug?
    – codeulike
    Commented May 26, 2022 at 10:18
  • 1
    @codeulike I don't think its a bug - once I'm logged in as this user, I'm not able to see any objects/apps/tabs/anything. For me its in Classic and only allows me to see my own user settings and edit them. I think this method is preferable to switching up profiles just to reset the token as other people suggested. Commented Sep 8, 2023 at 17:00

In the UI - change API only user profile to another non-api only user profile. Log in, reset security token. The IP range(s) on the profile assigned to the non-API User must allow your IP or you will not see the 'Reset Security Token' option on the User record.

  • Even in 2023, this seems to be the way to do this. Commented Mar 28, 2023 at 9:31
  • 1
    This was brought up (again) at a TDX 24 session in the hope that if we keep mentioning it, it might get fixed Commented Mar 15 at 13:16

You could try changing the users password.

From Security and the API (my emphasis):

Users can obtain their security token by changing their password or resetting their security token via the Salesforce user interface. When a user changes their password or resets their security token, Salesforce sends a new security token to the email address on the user’s Salesforce record. The security token is valid until a user resets their security token, changes their password, or has their password reset.

One way to change the password would be to use the setPassword() Partner API method from another valid API user.

UPDATE: It appears that the setPassword() method is insufficient to trigger sending the security token. Instead, see Dewid's answer.

Additionally, consider voting for the idea: Give the ability to change API Only User security token

  • 3
    A security token is sent on password resets only if it's received the first time through the UI option. Is that not so?
    – LVS
    Commented Dec 18, 2013 at 18:00

We are following the below steps. 1. Created a Custom Profile named 'API only' (API permission is enable). 2. Resetting the password from the UI or you may use Apex script if don't want to send any email to the API only user. 3. Use 'Login As' button from the User created above --> Go to My Settings from the User icon. 4. Reset the Security Token, an email will be sent to the User email ID. 5. log off.


The Integration User does not need the security token to be appended with password to get the access token. You can just send the client_id, client_secret, grant_type, username and password in a post request and the response will have the access token.

  • 1
    Using the Username-Password flow is not a good idea for anything other than a proof-of-concept. See this Salesforce help article for more details. The JWT Bearer flow would be more appropriate for headless (i.e. there isn't a browser involved, just a machine-to-machine connection) integrations.
    – Derek F
    Commented Sep 20, 2023 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .