I'm working on an integration of a web page that will consume a rest service to create a service request (in the BMC Heli xRemedyforce application)

When I run the rest on Postman, it's going smoothly, but when I'm testing on HMTL+JS, I'm always getting a 401 error.

I don't know if the error is in my code or if it is a restriction in salesforce. Below, I'm sharing the code

        <title>Test POST Rest API</title>
        <button type="submit" onclick="post()">POST</button>
        <script type="text/javascript" language="javascript">
            async function post() {
                const response = await fetch('https://inforegis--trnmnto.my.salesforce.com/services/apexrest/BMCServiceDesk/1.0/ServiceRequest', {
                    mode: 'no-cors',
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
                        'Authorization': 'Bearer <XXXX>',
                        'Access-Control-Allow-Origin': '*'
                    body:{"Fields": [{"Name": "requestDefinitionId","Value": "a3Hf0000000lTNaEAM"},{"Name":"client","Value": "0053j00000A7rWLAAZ"}],"Answers": [{"QuestionId": "a3Df0000000qI63EAE","Values": [ "Reclamação" ]},{"QuestionId": "a3Df0000000qHvsEAE","Values": [ "Solicitação de Serviço aberta por qualquer integração web" ]},{"QuestionId": "a3Df0000000qHwREAU","Values": ["Web"]}]}
                const myJson = await response.json(); //extract JSON from the http response
                // do something with myJson
                return myJson
    <body marginheight="0" marginwidth="0">


Now, I have created a personal domain and installed a SSL on it. Then I update the CORS with my domain

enter image description here

enter image description here

  • 1
    If that's a real Bearer Id, make sure you log out of it immediately. P.S. If that's exactly your code, the < and > in the bearer Id should not be there.
    – sfdcfox
    Commented Apr 16, 2021 at 21:13
  • Yes, this is the real bearer. I have tested from postman just now
    – Barcat
    Commented Apr 16, 2021 at 21:20
  • 2
    If you care about your account, log out of it before someone decides your user doesn't belong to you. Never post secrets in a public forum.
    – sfdcfox
    Commented Apr 16, 2021 at 21:21
  • Ok, changed it. But what about my issue? I have cleaned the <> and paste the new section id, but same 401 error
    – Barcat
    Commented Apr 16, 2021 at 21:24
  • You may need to add your site to CORS to work.
    – sfdcfox
    Commented Apr 16, 2021 at 21:28

1 Answer 1


You can not send Authorization header with no-cors mode. This request can only be sent with CORS policy enabled. In order to resolve this issue, it's needed to add CORS on your Salesforce account as the request's origin.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .