I am integrating an external system and they gave me an authorization token. I set the authorization token and it is working fine. I used SetHeader in HttpRequest.

Now they want to send a REST request to SFDC for another integration. I have created a connected app and ask them to hit the URL and get the access token.

https://login.salesforce.com/services/oauth2/token -d "grant_type=password" 
-d "client_id=********************OhAdICPQdnHyQqIRRoxxyMLaggiJOF_.l.HgS" 
-d "client_secret=***************" 
-d "username=****************" -d "password=********"

A series of questions have been raised:

  1. Do I need to create a connected app for the REST API? Is there any other way to authorize the external system REST request?
  2. Why do they need to make a call every time and get the access token? Can't I set a static authorization token in a header? They said, "We provided a token to you to set in header; you need to provide us the same. We can't make a call every time to get the access token."

1 Answer 1


Answering your questions in turn:

  1. You could use the SOAP login() call to get a session ID and use that in place of the access token, but then you have to create an XML request and parse the XML response.
  2. No. Access tokens/session IDs are time limited, and you have to authenticate to get one. There is no static token with Salesforce.
  • You can use refresh tokens to request new access tokens on demand (until revoked, etc), though, but not with the SOAP login() call or the Username-Password flow.
    – sfdcfox
    Nov 4, 2014 at 1:23
  • Right, but you still need to exchange the refresh token for an access token - you can't just use it in an API call as-is.
    – metadaddy
    Nov 4, 2014 at 1:28
  • True, but it's worth mentioning since that flow is what ultimately allows a third-party to have access that isn't time limited.
    – sfdcfox
    Nov 4, 2014 at 1:33
  • that means , In Salesforce , we can't have a token where we set http header and make the request. Every time , we need to request the access token. I have a qq, how come external shared static authorization token to make request everytime. they have shared something that i stored in custom setting and just put that in HEADER of http request. Nov 4, 2014 at 1:40
  • You can keep the access token for the length of the session - you don't have to authenticate for every request.
    – metadaddy
    Nov 4, 2014 at 5:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.