3

I want to invoke REST API of Salesforce (they are at: https://mySFDomain.my.salesforce.com/service/data/v57.0/composite - for example).

On an Enterprise Edition org, I can access with request like:enter image description here In the request, I have a bearer authentication token that I got from Apex variable {!GETSESSIONID()} or {!Api.Session_ID}

However, on Professional org, I cannot do so, It always returns "API_DISABLED_FOR_ORG". As Salesforce's stated, accessing REST API on Professional org is possible following this guide: https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/dev_packages_rest_api_access.htm Following the guide, I did:

  1. On my package org, I created a connected app with OAuth policies.
  2. My requested to Salesforce side with app's Consumer Key and app's Consumer Secret. They safelisted my connected endpoint now REST token is "MYCOMPANYNAME/MyProductName/"

Now, I don't know how to use this string ("MYCOMPANYNAME/MyProductName/") to access REST API. I have no idea at all. On the other try, following the other guide like: https://help.salesforce.com/s/articleView?id=sf.connected_app_client_credentials_setup.htm&type=5 and https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_client_credentials_flow.htm&type=5 I have tried request token with my created connected app from Postman like below capture: enter image description here POST to: https://MyPackageOrgDomain.my.salesforce.com/services/oauth2/token The request body includes: client_id, client_secret and grant_type. However, my request is failed as in capture (unsupported_grant_type). I have searched several topic, however, I found nothing.

I want to ask:

  1. How to use REST token ("MYCOMPANYNAME/MyProductName/") that Salesforce gave me? I just want to access REST API (https://mySFDomain.my.salesforce.com/service/data/v57.0/composite).
  2. How to access REST API with connected app's consumer key and consumer secret?
  3. In case I build my package and push it to AppExchange (of course, my package passed Salesforce security review already). My customer will install my package from AppExchange. How will be the connected app? There will be a connected app on each subscriber org or just only 1 connected app on my package org?

1 Answer 1

1

How to use REST token ("MYCOMPANYNAME/MyProductName/") that Salesforce gave me? I just want to access REST API (https://mySFDomain.my.salesforce.com/service/data/v57.0/composite).

You don't. This token is used for the SOAP API. See API Access in Group and Professional Editions for which APIs use which mode of access (note: some APIs can't be accessed in Group/Professional Edition).

How to access REST API with connected app's consumer key and consumer secret?

You need to use one of the OAuth Authorization Flows. I see you're trying to use the Client Credentials flow. This flow requires the Connected App to be configured in the subscriber org to use an Integration User. I don't think that's going to be available in a Professional Edition org. Instead, consider one of the other flows.

Which flow you need will depend on your application's design. Possible options might be the User-Agent (for desktop/mobile) or Web Server (for web apps). There's a lot of options to choose from, though, so definitely check the list in OAuth Authorization Flows.

You can configure Postman to use OAuth 2.0 to use one of the flows from the previous paragraphs to make testing easier. However, if you need to understand how the mechanism works directly, you could also try the Username-Password flow. This shouldn't be used in production, but it will help you test out the API.

In case I build my package and push it to AppExchange (of course, my package passed Salesforce security review already). My customer will install my package from AppExchange. How will be the connected app? There will be a connected app on each subscriber org or just only 1 connected app on my package org?

The first time the connected app is used in a subscriber org, it will automatically be installed. In other words, you will use the client_id and client_secret from your one Connected App. No additional configuration will be necessary.

6
  • I'm going to follow Username-Password flow first to understand it more clearly. However, I got a strange problem. On my building package org, I created the connected app. I send the request with required information to login.salesforce.com/services/oauth2/token, but it always get the return as: "error": "unsupported_grant_type","error_description": "authentication failure". I also signup a developer org and create a such same connected app. With developer org, I can get the token successfully. There is not any difference between 2 connected app. Do I need to turn on something on org? Commented Apr 18 at 8:24
  • 1
    @khoa_chung_89 If you look at the user detail for the user you're trying to log in as, you should see an error message in the Login History. This will be a clue for why you're getting these login errors.
    – sfdcfox
    Commented Apr 18 at 10:09
  • It's "Username-Password Flow Disabled" - perfectly what I'm looking for. Commented Apr 19 at 0:44
  • 1
    @khoa_chung_89 Yes, it's disabled by default. You can enable it, or use a different flow.
    – sfdcfox
    Commented Apr 19 at 8:22
  • after read and trying, I think OAuth JWT Bearer Flow is suitable for me: help.salesforce.com/s/…. I have done a demo like: youtube.com/watch?v=em-woF0HXpw and it works with a self-signed cert. Now, on production, I have tried a package and install on a subscriber org. I got errors like: invalid_client - invalid client credentials. From login history: Failed: Missing Consumer Key Parameter. From reading salesforce.stackexchange.com/a/132296 => If I bought a CA-Signed cert, would it be OK? Commented Apr 22 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .