When getting the access token from /services/oauth2/token, we pass the client_id, secret, username, password as parameters. Is there a way to pass it via header or part of the body?

  • Actually, I should say, I'm looking for options to send this information through the header. – Bergin Panimayam Apr 12 '18 at 23:28
  • I know this doesn't answer your question but can you explain your use case why you need to send this via the header? Unless there is no other option, I would not recommend using this OAuth at all because you are sending the password as part of the request... – Jannis Bott Apr 13 '18 at 5:13

You can create a key/value pair as form data (in the body) and pass it with the request. I have used this with postman and works perfectly fine. Just make sure you also add the security token with the password.

There doesn't seem a way to add it to header (if you try it you get an error saying grant type not supported. Additionally I would think, if Salesforce does not parse/support the information sent in header to retrieve the token, there is no way to do it.

enter image description here

In the example above, the form data is set on the request body and not sent as "parameters". On inspecting the code that is being sent in this request, you can find it as below.

POST /services/oauth2/token HTTP/1.1

Host: abc.my.salesforce.com

grant_type: password


client_secret: 123

username: username@username.com

password: pwdandsecuritytoken

Authorization: Bearer

However, if you would have set this as a parameter, if would be something as below

POST /services/oauth2/token?grant_type=password&client_id=abc;all other parameters

  • But form-data is again sent as parameters right? How to send as header? or part of the body as JSON? – Bergin Panimayam Apr 12 '18 at 20:56
  • Form data in a https/post request is part of body. Are you specifically looking as how to send it in header? – Jayant Das Apr 12 '18 at 21:16
  • Yes @Jayant Das, send it in the header. – Bergin Panimayam Apr 12 '18 at 23:17
  • @BerginPanimayam added some more details in the answer, if that helps. – Jayant Das Apr 13 '18 at 3:19
  • Thanks, Jayant, understand your point. However, our security team might not approve this and would expect the credentials to be passed in the header. – Bergin Panimayam Apr 13 '18 at 12:52

So found that there's not a way yet to send the credentials through the header. We are working on Mutual TLS to make it more secure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.