We have a REST resource apex class, and its sole purpose is to eliminate the problem of hitting Salesforce page view limits. The way it is currently setup doesn't seem to be eliminating this issue. Basically, it's supposed to act as a web service endpoint. We have a PHP relay that will call this apex class using curl. So far, the only way we've been able to give access to this class is publicly by allowing public access to this apex class in our site. What we've been trying to do to work around this is to try and use session IDs, but I'm running into a brick wall here.

This is the PHP code we are using to access the class:

$sessionIdURL = "https://test.salesforce.com/services/oauth2/token";
$sessionIdPostFields = "grant_type=password&client_id=our_client_id&client_secret=our_secret_key&username=our_username&password=our_password_w_security_token";
$c = curl_init();
curl_setopt($c, CURLOPT_URL, $sessionIdURL);
curl_setopt($c, CURLOPT_POSTFIELDS, $sessionIdPostFields);
curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
$sfResponse = curl_exec($c);

$accessToken = $sfResponse["access_token"];
$cc = curl_init();
curl_setopt($cc, CURLOPT_URL, $url);
curl_setopt($cc, CURLOPT_POSTFIELDS, $postFields);
curl_setopt($cc, CURLOPT_RETURNTRANSFER, true);
curl_setopt($cc, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    'Content-Length: ' . strlen($postFields),
    'Authorization: ' . $accessToken)
$response = curl_exec($cc);

I was able to get a session ID successfully. So then I decided to try and implement it with a call to our REST resource. However, whenever I remove public access to our apex class in the site manager it doesn't work. I've even tried setting up access to the Connected App I made for it on our site, but it still won't work unless the site allows public access to the apex class. What might I be doing wrong?

2 Answers 2


The correct format for the Authorization header is

Authorization: Bearer {access_token}

e.g. if your access token value is bobsaccesstoken then the header should be

Authorization: Bearer bobsaccesstoken

So your code needs changing to

'Authorization: Bearer ' . $accessToken
  • Jeez, Simon, I was literally just typing that!
    – metadaddy
    Jan 3, 2014 at 4:08

In order to access a REST resource from a Site you need to enable permissions on the apex class and any objects you access in order for it to work.

You can find a longer explanation explanation here: http://blogs.developerforce.com/developer-relations/2012/02/quick-tip-public-restful-web-services-on-force-com-sites.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .