I have enabled the Contacts app in SF to be connected and have the consumer and secret keys. Following the steps in

and others on stack exchange like:

My use case is customer used SOAP in Drupal 7 to push form info into Contacts. No other customer logins, just the API user for this form. I'm using the OAuth Web Server OAuth Authentication Flow since the keys will be transmitted by the Drupal form itself. Using these pages and copied my Consumer Key my curl is:

curl --verbose https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=3MVG9oNqAtcJCF.GRBswvYTYwd7MV40M02g..8BCLONGSTRINGREDACTED&redirect_uri=https%3A%2F%2Fnew.mydevsite.org%2Fsalesforce%2Foauth_callback

And my return is:

Connection #0 to host login.salesforce.com left intact

My selected OAuth scopes are:

  • Access and manage your data (api),
  • Provide access to your data via the Web (web),
  • Full access (full),
  • Perform requests on your behalf at any time (refresh_token, offline_access)

Require Secret for Web Server Flow is TRUE and as I understand it that comes in when I get the initial code from this step in order to get my token for when the real work begins. I can't even get to first base with the authentication as I read in the help pages.

Am I even on the right track to use OAuth and REST? We're transitioning to Drupal 8 and the Salesforce module SOAP class is empty. I'm fine with REST, just am missing something.

  • 1
    Did you redact the string or did salesforce? It looks like you did but I have seen salesforce pull info out of strings for security reasons so I just want to be safe.
    – gNerb
    Jun 12, 2018 at 18:50
  • This Page says you need to provide an access type parameter.
    – gNerb
    Jun 12, 2018 at 18:57
  • 1
    You are correct. I redacted the client_id. That said, I was puzzled by the two consecutive periods in that string but they are just that. I expanded my browser to be certain there wasn't responsive action going on. To be sure, I created separate dev account with different keys and still got same result.
    – sam452
    Jun 12, 2018 at 19:49
  • 1
    added &access_type=offline in different places to the above URI and same response. Copied key from html in Inspector to be certain I didn't miss any of the Customer Key.
    – sam452
    Jun 12, 2018 at 19:56


You must log in to answer this question.

Browse other questions tagged .