I have created public REST resource using APEX


global class RestWebservice {

  global static String helloWorld(){
    return 'HelloWorld';


it works perfectly when we make calls without Bearer Token Header.

curl --location --request GET 'https://stream-capricorn-3239-dev-ed.scratch.my.salesforce-sites.com/services/apexrest/helloWorld' \
--header 'Content-Type: application/json' \

Whereas my external system appends a reference bearer token header on each call it makes to salesforce is failing.

curl --location --request GET 'https://stream-capricorn-3239-dev-ed.scratch.my.salesforce-sites.com/services/apexrest/helloWorld' \
--header 'Authorization: Bearer dummy_value' \

Any help resolving this issue, Unable to change external system behaviour or add new header to the request.

The only option I have is handling through Salesforce, any chance we can bypass in Salesforce?

  • 2
    Could be interpreted as a SF platform bug, you can open a support case and let them know. A workaround is to send the request through your own proxy that strips the Authorization header.
    – identigral
    Commented May 1 at 20:10

1 Answer 1


This is a feature; you can theoretically log in to any Site, Community, etc. If you provide an authorization header, it will be interpreted as a Salesforce session. If Salesforce doesn't recognize the session token, it will reject the transaction.

This happens as one of the very first steps in any transaction with Salesforce, because it's what's used to set the user context for the rest of the transaction. This is important for security, as before the user is identified, Salesforce doesn't know if the user has permission to do anything yet. Any workaround is going to involve outside resources. For example, you can set up a small Heroku server to act a proxy to remove the header.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .