0

I am getting the following error when using the ANT Migration Tool to retrieve/deploy to our org's full sandbox.

"Failed Login: API security token required "

However, our org does NOT use Security tokens. I am able to log in successfully through the front end AND I'm able to log in through other means, like SFDX APIs. It is only when I've tried using the ANT Migration Tool that I'm seeing these failures. I am on API Version 44 of the tool.

I also confirmed that I'm on my local network.

Any thoughts or anyone else experiencing similar issues?

EDIT: I can deploy/retrieve using ANT on other sandboxes as well. There is only one of our full sandboxes that I am not able to get into because of this error.

  • go to setting from top right and reset you security token from there – Kushal Chauhan Nov 8 at 15:12
  • or just reset your password – Kushal Chauhan Nov 8 at 15:17
  • Thanks for a quick response, Kushal. I agree I could do that, but I shouldn't have to do that, because my org does not require security tokens. I've confirmed that I can log in using my current password into my org and through other APIs. Just not through the ANT Migration tool. – Maya Tran Nov 8 at 15:24
  • your ip must not be in trusted ip ranges of the org hence you need the token while accessing via ANT. – Kushal Chauhan Nov 8 at 15:35
  • Editing my post. I should have added that I'm able to log into other sandboxes for the same org, just not this particular sandbox. We have two full sandboxes, and I can run ANT in one but not the other. – Maya Tran Nov 8 at 15:57
0

SFDX uses OAuth, which is a browser-based authentication. Logging in to the UI is a browser-based authentication. Once you've logged in, you don't need to "activate" the browser again. If you've ever had to check your email or phone for a five digit code to log in, that's the alternative to Security Tokens for non-API logins. Browser-based logins never require a Security Token.

The API, including the Apex Data Loader, ANT Migration Toolkit, etc, uses a different authentication mechanism. You can't "activate" an API login, so a different mechanism is in play. A randomly generated 25-character extension to your password. You only need this for API logins, not browser-based logins. If you're not in the "trusted network", Security Tokens apply to you for all API logins. Browsers don't use this because they get a special authentication cookie that remembers that you've authenticated before from that browser. Try deleting your cookies, and you'll find you probably need a new 5-digit code sent to your email or phone.

You need to either use the Security Token (you can go in to Personal Setup to generate a new one), or add your IP address to the Trusted Networks area in Setup. Either way, you will need to take some sort of action to fix the problem. The system is working as designed, and you must follow the rules in order to use the API.

And yes, this applies from Sandbox to Sandbox. If you've never logged in from a given IP in a particular Sandbox, you'll need your Security Token, even if you've logged in to other Sandbox environments before. Each new org requires this. There's a special feature where the first IP you log in from in a given org is automatically "trusted", but if your IP address changes, or if you've never logged in before, the Security Token will be required until the IP is trusted by adding it to the Trusted Network settings.

  • Thank you for your sound advice. I will double check my IP, because I think it's odd that this sandbox started rejecting my login even though we've used this sandbox for a long time, and we haven't refreshed it since a few months ago. – Maya Tran Nov 8 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.