0

We have written the code in Salesforce and third party is accessing the data using REST.

Currently they are using grant type=password to access Salesforce resources. Since it requires username and password in the endpoint, Client wants to find an alternate so that userid and password should be passed in the body and not in the endpoint url.

What is the alternate for this? Can I use grant type=refresh_token?

PFB the endpoint url:

https://xxxx.com/services/oauth2/token?grant_type=password&client_id=xxxx&client_secret=xxxx&username=G@xxx.com&password=password

closed as unclear what you're asking by David Reed, battery.cord, glls, Reshma, Pranay Jaiswal Feb 28 at 9:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Have you taken a look at Understanding Authentication documentation? That should provide you with the details and help you to make a decision which flow you will need here. – Jayant Das Feb 27 at 14:01
2

Since it requires username and password in the endpoint

This is not correct. While you may have been using the attributes on your endpoint, but you don't need to send it as parameters with the endpoint

Client wants to find an alternate so that userid and password should be passed in the body and not in the endpoint url.

You should in fact always set the attributes in a request body, and that the attributes can be always set as body. As an example, below is how a request body looks like when invoking a REST API from POSTMAN.

grant_type:password
client_id:xxx
client_secret:xxx
username:xxx
password:xxxx

Can I use grant type=refresh_token?

This short answer is Yes. But, you will need to understand which authentication flow you want to utilize. This all depends on how you want to integrate with Salesforce.


I will recommend that you go through Understanding Authentication section on the REST API Developer Guide to get more details on this.

  • 1
    I used this and then added Content Type:application/x-www-form-urlencoded in header and it worked with Grant_type:password. – Gourishankar Mar 4 at 11:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.