For test purposes, I'm trying to use some customer's REST API on Salesforce. I don't have any API-consuming code yet (I'm just using CURL, OAuthDebugger, et similia).

I've tried the following this guide, but I'm stuck. This is what I've done:

Phase One: Getting the Authorization Code

  1. I've created a New Connected App with my user's mail
  2. I've set https://oauthdebugger.com/debug as callback URI

Question n.1: is there another way to get the redirected response?

  1. I've compiled OAuthDebugger as follows:

    • Authorize URI: https://test.salesforce.com/services/oauth2/authorize
    • Redirect URI: https://oauthdebugger.com/debug
    • Cliend ID: my Consumer Key
    • Scope: api
    • Response type: code
    • Response mode: form_post
  2. I've clicked Send Request, then logged in into Salesforce, and finally authorized the App

  3. I've been redirected to https://oauthdebugger.com/debug where I successfully got the Authorization Code.

Question n.2: After some time, the Authorization Code expired, but further calls to the same API returned the same (invalid) code again. How can I set/remove its expiration time, and how can I renew it to obtain a new one?

Phase Two: Getting the Token

  1. At this point, I need to call the Token URL (https://test.salesforce.com/services/oauth2/token) passing the Authorization Code and the Consumer Secret, to get a Token to use for the subsequent REST API calls. I can't use OAuthDebugger to perform this call, because of the Consumer Secret, so I'm resorting to CURL. I'm not able to get the returning token, by the way.

Question n.3: which callback URL should I use here?

Thanks in advance.

1 Answer 1


So here is my setup in Salesforce:

enter image description here

And then here is what I input into the OAuthDebugger form:

enter image description here enter image description here

So then when I clicked Send Request, it asked me to login, and then brought me to the authorize page:

enter image description here

And then redirected me back to here:

enter image description here

From there, you want to take the Auth Code that is received and "quickly" perform an grant_type=authorization_code call to get an access token:

POST /services/oauth2/token HTTP/1.1
Host: {your_domain}.salesforce.com
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: dd429871-b5ff-4764-b3b5-3a5f3bdac603

redirect_uri={your_callback_uri}& //Make sure this is URL encoded
code={your_auth_code} //Make sure this is URL encoded

And this should return you a response similar to this:

  "id": "https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P",
  "issued_at": "1278448101416",
  "refresh_token": "5Aep8614iLM.Dq661ePDmPEgaAW9Oh_L3JKkDpB4xReb54_pZebnUG0h6Sb4KUVDpNtWEofWM39yg==",
  "instance_url": "https://yourInstance.salesforce.com/",
  "signature": "CMJ4l+CCaPQiKjoOEwEig9H4wqhpuLSk4J2urAe+fVg=",
  "access_token": "00Dx0000000BV7z!AR8AQP0jITN80ESEsj5EbaZTFG0RNBaT1cyWk7TrqoDjoNIWQ2ME_sTZzBjfmOE6zMHq6y8PIW4eWze9JksNEkWUl.Cju7m4",
  "token_type": "Bearer",
  "scope": "id api refresh_token"
  • 1
    Thank you @Brian! This is exactly what I've done, I've probably waited too much before the authorization request and the token request, because now it worked. I've also been fooled by the Redirect URL parameter in the second call, thinking it was needed for a redirect, while it's only a simple parameter instead. Thanks again Commented Nov 21, 2019 at 15:31
  • 1
    @AndreaLigios no problem, also the oauthdebbuger website was new to me and I really like it. Thank you for sharing Commented Nov 21, 2019 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .