When getting the access token from /services/oauth2/token, we pass the client_id, secret, username, password as parameters. Is there a way to pass it via header or part of the body?
You can create a key/value pair as form data (in the body) and pass it with the request. I have used this with postman and works perfectly fine. Just make sure you also add the security token with the password.
There doesn't seem a way to add it to header (if you try it you get an error saying grant type not supported. Additionally I would think, if Salesforce does not parse/support the information sent in header to retrieve the token, there is no way to do it.
In the example above, the form data is set on the request body and not sent as "parameters". On inspecting the code that is being sent in this request, you can find it as below.
POST /services/oauth2/token HTTP/1.1
However, if you would have set this as a parameter, if would be something as below
POST /services/oauth2/token?grant_type=password&client_id=abc;all other parameters
So found that there's not a way yet to send the credentials through the header. We are working on Mutual TLS to make it more secure.