As an ISV partner I am building a web app to communicate between websites and salesforce. Essentially a many to many relationship where this connected app connects the website to a salesforce instance.

To achieve this I want to use the OAuth 2.0 Web Server Flow with a connected app with api and refresh scopes.

To begin the oAuth flow, the user will navigate to https://login.salesforce.com/services/oauth2/authorize with the client id/redirect url where they will approve the app.

When the app is approved, the connected app's callback will be invoked, which is a google cloud api.

From this api, I want to obtain a set of tokens from the https://login.salesforce.com/services/oauth2/token endpoint which I will then store for future use.

However, this endpoint requires a redirect url. I don't want or need another redirect, I just simply want the tokens to be returned in the request from made from the callback.

How can I achieve this?

This workaround, setting the redirect_uri to https://localhost/oauth returns exactly what I want, but surely there is a native way to do this with out needing a redirect uri at all

1 Answer 1


The redirect_uri is a security feature that should not be circumvented. When you allow localhost to receive the token, that means that anyone that can access your source code, such as on a client machine, can create a copycat app to impersonate your own app, potentially stealing data or being able to modify Salesforce data without the users' informed consent. You should use an appropriate mechanism to ensure that your app cannot be impersonated.

  • What is an appropriate mechanism? Would it be ok if I just set this redirect to the same callback url instead of localhost? Apr 22, 2023 at 0:02
  • @TemporaryFix Depends on the tech you're using. If it's a desktop/mobile app, use the User-Agent flow. If it's a web app, use an endpoint on the server you control. If it's a platform specific app, like Chrome or a console, you may use some sort of non-HTTP endpoint, such as myapp://oauth/success. Check out your target platform documentation for the specific URL you should use. Even though you yourself do not need a redirect URI, your security does need a redirect URI, and it must be something you control.
    – sfdcfox
    Apr 22, 2023 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .