Let's say we have 3rd party api that should reach salesforce. we want to transfer password and security token in using only one custom http header. is it possible to split these values? e.g. MyPleasurePAssworDMuxcrZ0nZHiKHY5eH7pj6q7O where MyPleasurePAssworD is password and the rest is token.

1 Answer 1


You should not be authenticating with a username and password when integrating a remote service. Instead, implement OAuth, using either the Web Server flow or the JWT flow.

Storing and transmitting raw user credentials is inherently less secure and is vulnerable to password and security token changes, while OAuth authentication is not.

The security token is concatenated to the end of the password where raw credentials are used, such as in the Username-Password OAuth flow or when performing a SOAP login() call. I'm not sure what you're referring to vis-a-vis a custom HTTP header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.