I'm currently dealing with an authentication issue with two different Salesforce REST API endpoints. We are trying to consume the API from inside a Visualforce page in a Salesforce community. To do this, we are grabbing the session id token from the sid cookie and using it as an "Authorization: Bearer token".

const sid = getCookie('sid')
const responsePromise = fetch(endpoint, { headers: { Authorization: 'Bearer ' + sid }})

The user type of the user currently hitting these endpoints is a System Admin with all permissions.

This token works for one of the endpoints being described here but not the other.

The first endpoint being hit is the User Profiles Photo endpoint.
POST /services/data/v44.0/connect/communities/:communityId/user-profiles/me/photo
Result: 200 successful and expected response

The second endpoint being used is one to download attachments from Salesforce:
POST /services/data/v44.0/sobjects/Attachment/:attachmentId/body
Result: 401 (Unauthorized) error and an INVALID_SESSION_ID error.

When hitting these endpoints and using a token generated when logging in directly to the API (e.g. Using SFDX to retrieve a token), both methods work.

What is the reason here for the inconsistent behavior of access token authentication and are there any ways I can get the same access token to work for every endpoint method?

2 Answers 2


Think of community as a sandbox within a larger SF org. If you authenticate to a community, your security context is restricted to this sandbox. You can do things within that sandbox but not outside of it. When you use SFDX to authenticate against the org, your security context is at the org level, thus the auth token (session id...) works for both community and org-level APIs. That's the reason for disparity you're seeing.

The best practice is to have your VF page call your custom server-side controller. The controller code could run in system mode, thus making it possible to execute operations that go beyond the sandbox on behalf of your community user.

Notwithstanding above, you can also check that your community user has been granted access to attachment you're trying to retrieve. Notes and Attachments aren't first-class citizens in the Salesforce permission model, they inherit permission of their parent object.


This might not be the answer you are looking for but will get there eventually.

Why do you think giving Salesforce community user API access is a good idea? giving API access means your community users can login and use complicated tools like DATA-Loader and if there is a malice in one of them you are just opening up the gate to hell by giving API Access.

Now your requirement is to show attachment data, you already have a VF page, thus you can use use apex and SOQL to get that. It's more secured and follows platform best practices.

  • A follow-up question I have is related to SOQL query limits. If this were implemented using SOQL as you suggest, how would you suggest getting around the heap size limits if attachments were large?
    – Kenny Diaz
    Jul 16, 2019 at 18:15
  • Get attachment id, nd it will hv a url to show publicly Jul 16, 2019 at 18:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .