When getting the access token from /services/oauth2/token, we pass the client_id, secret, username, password as parameters. Is there a way to pass it via header or part of the body?
You can create a key/value pair as form data (in the body) and pass it with the request. I have used this with postman and works perfectly fine. Just make sure you also add the security token with the password.
There doesn't seem a way to add it to header (if you try it you get an error saying grant type not supported. Additionally I would think, if Salesforce does not parse/support the information sent in header to retrieve the token, there is no way to do it.
In the example above, the form data is set on the request body and not sent as "parameters". On inspecting the code that is being sent in this request, you can find it as below.
POST /services/oauth2/token HTTP/1.1
username: [email protected]
However, if you would have set this as a parameter, if would be something as below
POST /services/oauth2/token?grant_type=password&client_id=abc;all other parameters