My Connected App authenticates using the OAuth 2 Username/password flow, which gives an "access_token" that I can use for authenticating REST queries via the "Authorization" HTTP header as a bearer token.

I have an apex class declared 'webservice' that I would like to call from my app. To do so, I need to download the WSDL and make a SOAP call to the class. Unfortunately, the customer would like to be able to update the class (which would invalidate the WSDL). Therefore, my app must be able to download the WSDL dynamically (and I can't just download it once and save it in my source code).

I'm having trouble correctly authenticating to download the WSDL. The URL I am using is:


I have tried the following, and each time receive a response (200 OK) with a javascript redirect to login.salesforce.com:

  1. adding HTTP header "Authorization: Bearer " like I do for REST requests.
  2. Adding cookie "sid=" because apparently the "access token" is a valid "session id" (see https://stackoverflow.com/a/46975117/315936)
  3. Adding GET parameter "oauth_token=" or "access_token=" (see https://help.salesforce.com/articleView?id=remoteaccess_using_access_token.htm&type=5)

It is possible I made a mistake trying one of those, but I don't think I did.

Searching github and the salesforce documentation, I have not found an example to reference for how to access this resource.

I thought I had a problem with my OAuth scopes, but unfortunately, the salesforce documentation for the username/password flow says:

This flow does not support including scopes in the request, and the access token returned from this flow does not get scopes.

Which seems kind of misleading, because according to the scopes documentation I should at least need the api scope for some of the other API calls I'm making. As far as I can tell though, there is no way to ask salesforce what scopes your current token has.

So, the question is: What is the correct way for me to access the WSDL resource for custom Apex dynamically? Do I need to user a different authorization method? Do I need to use a different login method?

  • So you are using https://<instance_url>/services/wsdl/class/ClassName as an Endpoint? Commented Sep 12, 2019 at 12:15
  • @ShaileshPatil Yes.
    – WirthLuce
    Commented Sep 12, 2019 at 23:30

1 Answer 1


I don't have an org at hand to test with an Apex webservice class, but I think this pattern will avail you.

What I typically do is use a session cookie store and start with a request to

https://myinstance.salesforce.com/secur/frontdoor.jsp?sid=<my access token>

Salesforce then creates all the cookies that are required for further HTTP requests to go through (as opposed to requests to the REST API that use regular Authorization: Bearer XXXXX headers).

In Python, it would look something like this:

import requests
session = requests.Session()
        my_instance, my_access_token
response = session.get(
  • I've also tried this, but it doesn't seem to work - for both the frontdoor.jsp request and the WSDL I get back html redirecting me to login. Note the documentation for frontdoor.jsp says "An example of a full session ID is the access_token obtained from OAuth authentication. One of the scopes specified when you create a connected app must be web or full.", which I double checked in my app (the only scope it has is full), but maybe this isn't compatible with the username/password flow?
    – WirthLuce
    Commented Sep 15, 2019 at 19:05
  • @WirthLuce Have you tried it with another flow? Say JWT or Web Server?
    – David Reed
    Commented Sep 15, 2019 at 19:45
  • The flow won't matter, the WSDL download does some funky stuff in JS. Try a client-side browser automation library such as Selenium.
    – identigral
    Commented Sep 17, 2019 at 2:28
  • @identigral Ah, I didn't know that. Any interest in sketching an answer out so I can delete this misguided one?
    – David Reed
    Commented Sep 17, 2019 at 14:16
  • @DavidReed I tried but got lost in JS :(
    – identigral
    Commented Sep 17, 2019 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .