This article about oAuth 2.0 says , that user must provide security token to log in. Can i somehow disable usage of security tokens? I don't want my users to perform unnecessary operation.

Or may be there is some alternative way to find out , if user's login\password are valid in salesforce

My code to authorize (may be there is another issue why i have an error like

{"error_description":"expired access/refresh token","error":"invalid_grant"} )

    private const string ClientId = "3MVG9A2kN3Bn17huRprJBCInrodPdsyHERlP1nUDPXnApOiQURGxtr9pxl...."; // Consumer Key from SFDC account
    private const string ClientSecret = "43802039754906815..."; // Consumer Secret from SFDC account
    private const string RedirectUrl = "https://localhost:8443/...."; // Redirect URL configured in SFDC account
    private const string  SfOAuthUrl = "https://login.salesforce.com/services/oauth2/token";

public static void AuthenticateToSalesforce()
        var username = "[email protected]";
        var password = "MyPassword_Without_Security toke";

        var parameters = "grant_type=password"
                                  + "&client_id=" + ClientId
                                  + "&client_secret=" + ClientSecret
                                  + "&redirect_uri=" + RedirectUrl
                                  + "&username=" + username
                                  + "&password=" + password;

        var result = HttpPost(@SfOAuthUrl, @parameters);

    public static string HttpPost(string URI, string Parameters)
        var req = WebRequest.Create(URI);
        req.ContentType = "application/x-www-form-urlencoded";
        req.Method = "POST";

        var data = Encoding.ASCII.GetBytes(Parameters);
        req.ContentLength = data.Length;
        var os = req.GetRequestStream();
        os.Write(data, 0, data.Length);

            var resp = req.GetResponse();
            var sr = new StreamReader(resp.GetResponseStream());
            return sr.ReadToEnd().Trim();
        catch (WebException ex)
            var resp = new StreamReader(ex.Response.GetResponseStream()).ReadToEnd();
        return string.Empty;

I've also set the range of trusted IPs which, according to the article, should disable usage of security tokens, but error is still the same

  • I suggest that you get your code working using the password and security token first as it is very easy to get the parameter encoding and other aspects of the code wrong and confuse one problem with another problem. But I do recollect being able to leave out the security token when I had "IP Restrictions" set to "Relax IP restrictions" but have since changed to using one of the other OATH flows. I am unsure of the security pros/cons.
    – Keith C
    Feb 17, 2014 at 19:30

2 Answers 2


Security Tokens are not required from Trusted IP addresses.

You can make a single range of IP address 'trusted' in Setup > Security Controls > Network Access.

You can blat out multiple ranges like to (not recommended) on a Profile too.

Keith C's commentary is well placed; holding user credentials (and security token) may be a red flag.

profile ip range

  • 2
    I tried the question code out with some test user credentials where my IP was trusted. It worked fine without the security token. Feb 18, 2014 at 1:08
  • Note that I don't think you can block out the entire list of IPV4 addresses in one go. You need to do it in smaller ranges. Feb 18, 2014 at 1:09
  • They blocked that a few releases ago, yes.
    – sfdcfox
    Feb 18, 2014 at 1:18
  • @DanielBallinger perhaps not for the best, but from any Profile under Login IP Ranges the entire IPV4 space can indeed be trusted, obviating security tokens (Winter '14) Feb 18, 2014 at 1:27
  • 1
    @user320 Interesting. I once had to make a tool to block out all the IP ranges for a testing org (long story). Good to know it can be done in a straight forward manner. Feb 18, 2014 at 2:01

The token's only required if you use user/pass flow, which is not recommended for normal, production-ready OAuth2 implementations (it's the same as trying to make a SOAP login() call). Instead, use the user-client flow, which follows the normal Identity Confirmation flow (e.g. a SMS or email verification code). In C#, for example, you can use a WebBrowser control to present the OAuth2 login. If the user's default browser is Internet Explorer, and they are already logged in through another window, and they've already granted access, the login will complete automatically with no interaction from the user at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .