I am using Postman to make a request to my Salesforce domain:


The response shown in the above example:

    "error": "unsupported_grant_type",
    "error_description": "grant type not supported"

That is with the Content-Type header set to application/x-www-form-urlencoded.

Then, if I move the data from Body into Params, I get the following response:


    "access_token": "00D7Q00000D2HbY!AQ8AQNyz...",
    "signature": "9IMgiZLiUughUYuA7WlXUmqqdApG0aq60mkMj7VJhUE=",
    "scope": "Test openid",
    "instance_url": "https://curious-panda-tcxxxn-dev-ed.trailblaze.my.salesforce.com",
    "id": "https://login.salesforce.com/id/00D7Q00000D2HbYUAV/0057Q000007e7FIQAY",
    "token_type": "Bearer",
    "issued_at": "1686654589947"

Can anyone explain to me, what I'm doing wrong? As per the documentation, I should be able to put the parameters in the Body to make the request more secure:

To initiate the flow, the connected app posts its client credentials to the Salesforce token endpoint. You can include the client credentials as parameters in the body of the request. Or, for added security, put your client credentials in a Basic authorization header.


Please see also the headers I am using below:

enter image description here

2 Answers 2


After about 8 hours of testing etc. I found out that the Salesforce instances generated as Trailhead Playgrounds can not receive the OAuth requests with params in body. Any domain that ends with trailblaze.my.salesforce.com will return the unsupported_grant_type error.

I found out when I tested on a developer org where I received a successful response.


I can confirm that what you are trying should work; here's a successful test I ran in Postman with the same config: Postman Screenshot

There must be some other issue. I would double check the client id/secret values in the body version. Perhaps clear and re-type client_credentials in case there is a space or other non-printable pasted in there.

  • Thank you so much. At least I know it should work.
    – DevelBase2
    Jun 13, 2023 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .