Calling REST APIs from PHP with curl

Question

I've successfully received an access token thru the API, but no matter what I do I keep getting this "INVALID_SESSION_ID". Does this mean the access key is invalid? I've tried lots of suggestions from StackExchange here but nothing has worked. Is there anything wrong with my code?

    $data = [[
        'FirstName' => 'Johnny',
        'LastName' => 'Appleseed',
    ]];

    $token = 'XXX';
    $instance = 'https://XXX.salesforce.com';

    // Initialize
    $request = curl_init( $instance . '/services/data/v42.0/sobjects/Contact' );

    // Set Options
    curl_setopt($request, CURLOPT_HTTPHEADER, [ 'Authorization: Bearer ' . $token ]);
    curl_setopt($request, CURLOPT_HTTPHEADER, [ 'Content-Type: application/json' ]);
    curl_setopt($request, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($request, CURLOPT_TIMEOUT, 10);
    curl_setopt($request, CURLOPT_POST, 1);
    curl_setopt($request, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($request, CURLOPT_POSTFIELDS, json_encode($data) );

    // Make Request
    $response = json_decode(curl_exec($request));

    // Close Request
    curl_close($request);

Answer 1

The issue was that I needed to include all headers as an array. Apparently you can't have multiple CURLOPT_HTTPHEADER options, they need to be included in a single array!

curl_setopt($ch, CURLOPT_HTTPHEADER, array( 'Authorization: OAuth '.$token,
        'Content-Type: application/json', 'X-PrettyPrint: 1' ));

Answer 2

Was looking for a simple curl example to read data. This page was first listed in Google, found an easy and clear code example here: https://choy.medium.com/accessing-salesforce-data-via-rest-username-password-oauth-flow-to-a-connected-app-using-php-curl-f1aa37fb463f

Answer 3

Try using array for header and token,

curl_setopt($request, CURLOPT_HTTPHEADER, array( $token, "Content-Type: application/json", "cache-control: no-cache" ));

I added cache-control, as most server-sides cache their responses. in first try we may get fresh one, but subsequent ones will be cached. Old practice was to add a random variable to the end of the link to keep the results fresh. If you need fresh results use cache control, or pretty ones are ok. Of course whether this method will work is dependent on the server or website we’re sending the HTTP request to. We can also add no-store to make sure request shouldn’t be cached at all