1

When getting the access token from /services/oauth2/token, we pass the client_id, secret, username, password as parameters. Is there a way to pass it via header or part of the body?

Improve this question
2
  • Actually, I should say, I'm looking for options to send this information through the header.
    – Bergin Panimayam
    Apr 12, 2018 at 23:28
  • I know this doesn't answer your question but can you explain your use case why you need to send this via the header? Unless there is no other option, I would not recommend using this OAuth at all because you are sending the password as part of the request...
    – Jannis Bott
    Apr 13, 2018 at 5:13

1 Answer 1

Reset to default
2

You can create a key/value pair as form data (in the body) and pass it with the request. I have used this with postman and works perfectly fine. Just make sure you also add the security token with the password.

There doesn't seem a way to add it to header (if you try it you get an error saying grant type not supported. Additionally I would think, if Salesforce does not parse/support the information sent in header to retrieve the token, there is no way to do it.

enter image description here

In the example above, the form data is set on the request body and not sent as "parameters". On inspecting the code that is being sent in this request, you can find it as below.

POST /services/oauth2/token HTTP/1.1

Host: abc.my.salesforce.com

grant_type: password

client_id:xyzzzzzz

client_secret: 123

username: [email protected]

password: pwdandsecuritytoken

Authorization: Bearer

However, if you would have set this as a parameter, if would be something as below

POST /services/oauth2/token?grant_type=password&client_id=abc;all other parameters

Improve this answer
5
  • But form-data is again sent as parameters right? How to send as header? or part of the body as JSON?
    – Bergin Panimayam
    Apr 12, 2018 at 20:56
  • Form data in a https/post request is part of body. Are you specifically looking as how to send it in header?
    – Jayant Das
    Apr 12, 2018 at 21:16
  • Yes @Jayant Das, send it in the header.
    – Bergin Panimayam
    Apr 12, 2018 at 23:17
  • @BerginPanimayam added some more details in the answer, if that helps.
    – Jayant Das
    Apr 13, 2018 at 3:19
  • Thanks, Jayant, understand your point. However, our security team might not approve this and would expect the credentials to be passed in the header.
    – Bergin Panimayam
    Apr 13, 2018 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .