I'm learning the REST Api in order to write some integration code with our Salesforce implementation. As a first step, I signed up as a Salesforce developer, and did several of the tutorials.

I then registered a connected app on my dev site, and worked through the necessary queries to establish a session using oAuth2 password flow, and exercised several operations similar to what I will need to do for our integration.

With that success, I moved on to our corporate dev sandbox site to do the same. We have some custom objects I will need to access and manipulate, so wanted to make sure I could get at them.

Using the same kind of query to get a token as I did on my dev site, I always get a 400 Bad Request response, with the result content of: "unsupported grant type". Spending a day searching for that, I tried all the suggested fixes - setting the correct content-type header, using the proper consumer key and consumer secret, appending my access token to the password, etc. Nothing helped. I'm quite certain that my request is correct.

Looking at it more, and following the timeline of events for the request, I see that on the successful site the 200 OK response is received right after the POST to /services/oauth2/token. But the failing site gets a "302 Redirect Found" in response. From my query to OurSite.lightning.force.com/services/oath2/token we are redirected to OurSite.my.salesforce.com/services/oauth2/token as a GET instead of the original POST. This returns the 400 Bad Request.

Is there some setting somewhere that may be causing this redirect? Our Salesforce Admin is not aware of one, but he's fairly new to Salesforce.

Any other thoughts on how I can overcome this?

  • I do have a connected app in the sandbox, yes. See the answer from sfdcfox below for the resolution.
    – Alan Fors
    Mar 28, 2019 at 19:18

1 Answer 1


Sandboxes and production servers (including Developer Edition orgs) have different login servers. To log in to your sandbox, you'll need to use test.salesforce.com or OurSite--SandboxName.my.salesforce.com. Also, please keep in mind that the Password flow is not recommended for production use, so make sure you plan to switch to the user-client or web-server flow.

  • Thanks, that worked using the other login server. Yes, I will switch to web-server flow once I actually start writing code for this, but password flow is easier for just testing the API using Insomnia or postman or similar.
    – Alan Fors
    Mar 28, 2019 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .