Basically, I'm trying to figure out a way to authorize an application to use the Tooling API, but I would like to not have to set up a Connected Application. I've seen this question, but it doesn't really help me understand how to do it.

I've read about the Web-Server auth flow and the User-Agent flow, but both need a Consumer Key, according to the docs. What am I missing? If the only way to do this, like the previously cited answer states, is to use a SOAP login call and then with the key, do the REST calls, why is that?


There are several possible ways to authenticate your Client App making API calls to Salesforce: OAuth 2.0, SessionId and SOAP SessionID. That's it.

(1) Understanding Authentication with OAuth:

Salesforce uses the OAuth protocol to allow users of applications to securely access data without having to reveal username and password credentials.

(2) As @sfdcfox states in his answer, SessionId is basically used for testing purposes. And this is fair because SessionId is valid as long as user's session is live.

(3) As a third option you can use the login() SOAP call that in case of success will return LoginResult with sessionId which you then use in API REST calls, like here.

Although with option 3 you don't need to set up a connected app, you will have to deal with 2 APIs SOAP and RESP, which might not be very convenient.

| improve this answer | |
  • I have a couple of questions based on your answer: why is the SessionId only used for testing purposes, and why can't I obtain it via the REST API? And thirdly, what's the difference between a SessionId and an AccessToken emitted by the REST API? – Javier García Manzano Jul 27 '18 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.