I am working on a nodejs app using jsforce to authenticate users their Salesforce org with nodejs app and this is how it works at high level:

  1. User launches nodejs app and login screen is shown with two buttons:
    1. Login to Production Org
    2. Login to Sandbox Org
  2. User is redirected to login.salesforce.com or test.salesforce.com depending on which button was clicked.
  3. User logins and approves the connected app and callback url is invoked with auth code.
  4. Now I am confused if user did the authentication from a Production org or Sandbox org. I need that information to authorize my app.

I need this information so that I can properly set loginUrl property when creating oauth2 object for jsforce(refer to the below code).

One option I can see is depend on the referrer header of request when callback url is invoked but there might be better options? Is there a better alternative?

NOTE: If i default loginUrl to login.salesforce.com and user is authenticating sandbox org, I am getting invalid_grant error.

const jsforce = require("jsforce");
const app = express();

// Callback function to get Auth Token
app.get('/oauth2/callback', (req, res) => {
  const oauth2 = new jsforce.OAuth2({
      loginUrl: 'https://login.salesforce.com',
      clientId: 'SALESFORCE_CLIENT_ID',
      clientSecret: 'SALESFORCE_CLIENT_SECRET',
      redirectUri: 'http//localhost:3001/oauth2/callback',
    const conn = new jsforce.Connection({ oauth2: this.oauth2 });
    const { code } = req.query;
    conn.authorize(code, (error) => {
      if (error) {
        console.error("Failed to authorize request with provided authentication code");
      console.error("authorize worked successfully");

We use the state parameter to tell us that. So the URLs behind the button would be something like this

sLiveURL = 'https://login.salesforce.com/services/oauth2/authorize?state=jslive' + endpointinfo

sTestURL = 'https://test.salesforce.com/services/oauth2/authorize?state=jstest' + endpointinfo

And then you can read the state parameter in the URL that is passed to the oAuth redirect_uri URL and determine if the request is from live or test

  • Not sure if I am doing something wrong but when I add url parameter like you mentioned, it is not present when my callback url is invoked. – javanoob Nov 17 '20 at 1:38
  • Should be based on the docs: help.salesforce.com/… – BritishBoyinDC Nov 17 '20 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.