When getting the access token from /services/oauth2/token, we pass the client_id, secret, username, password as parameters. Is there a way to pass it via header or part of the body?
-
Actually, I should say, I'm looking for options to send this information through the header.– Bergin PanimayamApr 12, 2018 at 23:28
-
I know this doesn't answer your question but can you explain your use case why you need to send this via the header? Unless there is no other option, I would not recommend using this OAuth at all because you are sending the password as part of the request...– Jannis BottApr 13, 2018 at 5:13
1 Answer
You can create a key/value pair as form data (in the body) and pass it with the request. I have used this with postman and works perfectly fine. Just make sure you also add the security token with the password.
There doesn't seem a way to add it to header (if you try it you get an error saying grant type not supported. Additionally I would think, if Salesforce does not parse/support the information sent in header to retrieve the token, there is no way to do it.
In the example above, the form data is set on the request body and not sent as "parameters". On inspecting the code that is being sent in this request, you can find it as below.
POST /services/oauth2/token HTTP/1.1
Host: abc.my.salesforce.com
grant_type: password
client_id:xyzzzzzz
client_secret: 123
username: [email protected]
password: pwdandsecuritytoken
Authorization: Bearer
However, if you would have set this as a parameter, if would be something as below
POST /services/oauth2/token?grant_type=password&client_id=abc;all other parameters
-
But form-data is again sent as parameters right? How to send as header? or part of the body as JSON? Apr 12, 2018 at 20:56
-
Form data in a https/post request is part of body. Are you specifically looking as how to send it in header? Apr 12, 2018 at 21:16
-
-
@BerginPanimayam added some more details in the answer, if that helps. Apr 13, 2018 at 3:19
-
Thanks, Jayant, understand your point. However, our security team might not approve this and would expect the credentials to be passed in the header. Apr 13, 2018 at 12:52