I am integrating an external system and they gave me an authorization token. I set the authorization token and it is working fine. I used SetHeader in HttpRequest.

Now they want to send a REST request to SFDC for another integration. I have created a connected app and ask them to hit the URL and get the access token.

https://login.salesforce.com/services/oauth2/token -d "grant_type=password" 
-d "client_id=********************OhAdICPQdnHyQqIRRoxxyMLaggiJOF_.l.HgS" 
-d "client_secret=***************" 
-d "username=****************" -d "password=********"

A series of questions have been raised:

  1. Do I need to create a connected app for the REST API? Is there any other way to authorize the external system REST request?
  2. Why do they need to make a call every time and get the access token? Can't I set a static authorization token in a header? They said, "We provided a token to you to set in header; you need to provide us the same. We can't make a call every time to get the access token."

1 Answer 1


Answering your questions in turn:

  1. You could use the SOAP login() call to get a session ID and use that in place of the access token, but then you have to create an XML request and parse the XML response.
  2. No. Access tokens/session IDs are time limited, and you have to authenticate to get one. There is no static token with Salesforce.
  • You can use refresh tokens to request new access tokens on demand (until revoked, etc), though, but not with the SOAP login() call or the Username-Password flow.
    – sfdcfox
    Commented Nov 4, 2014 at 1:23
  • Right, but you still need to exchange the refresh token for an access token - you can't just use it in an API call as-is.
    – metadaddy
    Commented Nov 4, 2014 at 1:28
  • True, but it's worth mentioning since that flow is what ultimately allows a third-party to have access that isn't time limited.
    – sfdcfox
    Commented Nov 4, 2014 at 1:33
  • that means , In Salesforce , we can't have a token where we set http header and make the request. Every time , we need to request the access token. I have a qq, how come external shared static authorization token to make request everytime. they have shared something that i stored in custom setting and just put that in HEADER of http request. Commented Nov 4, 2014 at 1:40
  • You can keep the access token for the length of the session - you don't have to authenticate for every request.
    – metadaddy
    Commented Nov 4, 2014 at 5:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .