enter image description here

I am trying to POST to the API Endpoint https://login.salesforce.com/services/oauth2/token as shown in the screenshot

this is the first step towards authentication which is failing and giving an error of "invalid grant", "authentication failure"

I don't know what I am doing wrong. Can anyone point out my mistake

I have tried the solution in this example {"error":"invalid_grant","error_description":"authentication failure"} but it didn't work for me

Edit: I have tried different urls , different grant_types differnt username and password

I have tried test.salesforce.com/services/oauth2/token I have tried midwich4.my.salesforce.com/services/oauth2/token

I have tried using curl or postman both

the result is same for all three urls error:invalid grant -> "error_description":authentication failure

  • 1
    there is more than 1 post on this site with troubleshooting steps for this error. also, a screenshot with the method, url and error wont help much in this case, you will probably want to ensure your headers are properly set.
    – glls
    Commented Jan 10, 2022 at 2:47
  • I have tried all examples. and I am still unclear on what i am doing incorrectly, everything gives invalid_grant error Commented Jan 10, 2022 at 3:08
  • 1
    as previously mentioned, you will need to share more info on what you have tried and request data for us to help.
    – glls
    Commented Jan 10, 2022 at 3:19
  • 3
    Also, why are you using username/password? nowadays, this is not really a recommended approach.
    – glls
    Commented Jan 10, 2022 at 3:20
  • 1
    I would strongly recommend reading help.salesforce.com/s/… and help.salesforce.com/s/…
    – David Reed
    Commented Jan 10, 2022 at 3:59

1 Answer 1


The critical note from OAuth 2.0 Username-Password Flow for Special Scenarios says:

When using the username-password flow with an API, create a field in the username and password login screen where users can enter their security token. The security token is an automatically generated key that must be added to the end of the password to log in to Salesforce from an untrusted network. Concatenate the password and token when passing the request for authentication.

(Emphasis mine; this turns out to be the problem here).

OAuth flows can present generic errors for a wide variety of issues, including this one; it's critical to follow the setup instructions to the letter, as well as maintaining awareness of configuration (such as IP restrictions) in the specific Salesforce environment you are using.

It is also important to note that the Username-Password Flow should not be used in production for integration activities. Use the Username-Password Flow only for, as the documentation says, special scenarios - such as one-off testing. In production, use the Web Server or JWT Flow, which avoid storing user credentials and survive a password reset.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .