I want to use package JSforce to Query SF data using external app.

Can do it quite easily by using userName/password/token

conn.login('someusername', 'somepassword+token', function(err, userInfo) {
//verify result....

Now I'm trying to do it with connect App, which I setup in SF. According to the documentation I should first use the connect app settings (client/secret Id), and then login with the user name/password. But I don't want to use the user name/password. Is it possible to avoid it and make the connection only by using the connected app?

var jsforce = require('jsforce');
var conn = new jsforce.Connection({
  oauth2 : {
    // you can change loginUrl to connect to sandbox or prerelease env.
    // loginUrl : 'https://test.salesforce.com',
    clientId : '<your Salesforce OAuth2 client ID is here>',
    clientSecret : '<your Salesforce OAuth2 client secret is here>',
    redirectUri : '<callback URI is here>'
conn.login(username, password, function(err, userInfo) {
  if (err) { return console.error(err); }
  // Now you can get the access token and instance URL information.
  // Save them to establish connection next time.
  // logged in user property
  console.log("User ID: " + userInfo.id);
  console.log("Org ID: " + userInfo.organizationId);
  // ...


1 Answer 1


But I don't want to use the user name/password. Is it possible to avoid it and make the connection only by using the connected app?

Providing username/password is to make sure you are authenticating yourself and authorizing the (connected) app to act on your behalf. You cannot skip authentication as part of OAuth 2.0. At one point of time you will need to provide the username/password to be able to authenticate yourself, and then you can utilize the auth token in subsequent calls.

As for how you can authenticate your app, take a look at Authenticate Apps with OAuth which lists down the different ways that you can utilize based on your use case. If you don't want to authenticate every time using username/password, you should take a look at OAuth 2.0 JWT Bearer Token Flow or the OAuth 2.0 Refresh Token Flow.

  • Thanks, This explanation very help to clarify the issue. I'm familiar with JWT but seems the disadvantage in this case is that it will require 2 API calls every time I need to connect. First post call to get token from the JWT app, and then logic with the JSforce object to connect. I will read more about the other links.
    – Liron C
    May 1, 2019 at 16:13
  • Actually you will not need to hit twice as long as your token is valid. However if it expires, then you will definitely need to get the new token first before accessing the resource. That's how OAuth 2.0 is designed to work.
    – Jayant Das
    May 1, 2019 at 16:25
  • @JayantDas Many of the oAuth flows you've linked to do not require username/pwd so the phrase "You cannot skip authentication as part of OAuth 2.0" in context of your next sentence where you equate authentication to providing username/password is technically incorrect.
    – identigral
    May 1, 2019 at 18:25
  • @identigral Not requiring a username/password for authentication vs. not authenticating are two different things. You will always need to authenticate irrespective of any flow you choose.
    – Jayant Das
    May 1, 2019 at 18:27

Not the answer you're looking for? Browse other questions tagged .