I build an apex rest API that is returning base64 to client. API works fine with PostMan/soapUI. When i try to invoke same Apex REST API from my another developer Account I am getting HttpResponse[Status=Unauthorized, StatusCode=401]"|. Initially I was getting Return code 302 and in debug log i saw it was redirecting to domain URL and then i changed End point to domain URL so return code 302 does not appear but now keep getting 401. I checked Salesforce documentation but unable to find anything specific to 401 error code.

Any idea if i am doing something wrong in my code ?

    HttpRequest tokenRequest = new HttpRequest();
    String CLIENT_ID = ‘xxxxxxxxxxxxxxxx’;
    String CLIENT_SECRET = ‘xxxxxxxxxxxxxxxx’;
    String USERNAME = ‘xxxxxxxxxxxxxxxx’
    String PASSWORD = ‘xxxxxxxxxxxxxxxx’
    tokenRequest.setBody('grant_type=password' + '&client_id='+CLIENT_ID + 
                '&client_secret='+CLIENT_SECRET + '&username='+USERNAME + '&password='+PASSWORD);
    Http http1 = new Http();
    HTTPResponse responseToken = http1.send(tokenRequest);
    string tran = ‘xxxxxxx03zsTNQAY'; // for test purpose only
    string endpoint = 'https://xxxxx--xxxxxxx.my.salesforce.com/services/apexrest/v1/getdetails?transactionid='+tran;
    HttpRequest request = new HttpRequest();
    request.setHeader('Content-Type', 'application/json');
    request.setHeader('Authorization', 'Bearer ' +responseToken.getBody()); 
    Http http = new Http();
    HTTPresponse res= http.send(request);
/* Added to handle 302 return code 
        while (res.getStatusCode() == 302) {                
            res = new Http().send(request);
            system.debug('Calling Again !!! ');
        system.debug(' Location header from respose :'+ res.getHeader('Location'));
        system.debug(' Response :'+ res);
    } catch(exception e){
        System.debug('ERROR: '+ e.getMessage());  
  • The HTTP 401 Unauthorized client error status response code indicates that the request has not been applied because it lacks valid authentication
    – glls
    Commented Aug 20, 2021 at 15:09
  • Thanks for response @gll - I see in debug log that i am getting Access token successfully and no error in that part.
    – Sfdc_1184
    Commented Aug 20, 2021 at 15:12
  • you are getting the access token, but your request to https://xxxxx--xxxxxxx.my.salesforce.com/services/apexrest/v1/getdetails?transactionid='+tran is failing ?
    – glls
    Commented Aug 20, 2021 at 15:13
  • yes, once control reach to End Point it throw 401 and same endpoint works perfectly fine with soapUI/Postman.
    – Sfdc_1184
    Commented Aug 20, 2021 at 15:15
  • are you using the same salesforce endpoint when trying to invoke getdetails in postman than in your apex code?
    – glls
    Commented Aug 20, 2021 at 15:18

1 Answer 1


You are not passing only the access_token value, but the whole response body in the Authorization header of the second callout, here:

request.setHeader('Authorization', 'Bearer ' +responseToken.getBody()); 

responseToken.getBody() returns a JSON string like this:

  "access_token": "00DR00000008oBT!AQwAQCPqzc_HBE59c80QmEJD4rQKRRc1GRLvYZEq...",
  "instance_url": "https://MyDomainName.my.salesforce.com",
  "id": "https://login.salesforce.com/id/00DR00000008oBTMAY/005R0000000IUUMIA4",
  "token_type": "Bearer",
  "issued_at": "1513887500425",
  "signature": "3PiFUIioqKkHpHxUiCCDzpvSiM2F6//w2/CslNTuf+o="

What you must provide in the Authorization header is only the value of access_token property.

You can use JSON.deserializeUntyped to parse that JSON string into a Map<String, Object> from which getting the access_token.

Map<String, Object> authMap = (Map<String, Object>) JSON.deserializeUntyped(responseToken.getBody());
request.setHeader('Authorization', 'Bearer ' + authMap.get('access_token'));

By the way, instead of hardcoding the whole endpoint, you can get the instance domain from that JSON:

String endpoint = authMap.get('instance_url') + '/services/apexrest/v1/getdetails?transactionid='+tran;
  • Thanks @RubenDG ! It worked perfectly. I completely missed that part.
    – Sfdc_1184
    Commented Aug 20, 2021 at 17:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .