I have a question about authentication in the REST API of SalesForce. I have created an API that I can access using hurl.it in combination with RuneScope Token Generator. This works fine and I can access the code but when I try to do the same in a Java applcation, it doesn't work.I think it's because my redirect url is at fault but I don't know how to use it; it says https://localhost:8443/RestTest/oauth/_callback on the SalesForce REST authentication page but what am I looking at here? An app called RestTest, that is accepting calls on port 8443 and has a class called oath and a method called _callback? I'm lost here, please some help. I fill in everything like I don int the RuneScope Token Generator but always get a 400 - bad request. Any ideas? here's my code

 public String getAccessToken( ) throws IOException
            URL url                             = new URL( "https://eu3.salesforce.com/services/oauth2/token" );
            OutputStreamWriter out              = null;            
                HttpURLConnection connection    = ( HttpURLConnection )url.openConnection( );

                connection.setUseCaches( false );
                connection.setDoOutput( true );
                connection.setDoInput( true );

                connection.setRequestProperty("charset", "utf-8");
                connection.addRequestProperty( "grant_type", "authorization_code" );
                connection.addRequestProperty( "response_type", "code" );

                connection.addRequestProperty( "Accept", "*/*" );
                connection.addRequestProperty( "Accept-Encoding", "gzip, deflate, compress" );

                connection.addRequestProperty( "clientId", client_id );
                connection.addRequestProperty( "clientSecret", client_secret );

                connection.addRequestProperty( "username", username );
                connection.addRequestProperty( "password", password );

                connection.setRequestMethod( "POST" );

                connection.setConnectTimeout(1000 * 5);
                connection.connect( );

                //out = new OutputStreamWriter( connection.getOutputStream( ) );
                System.out.print( connection.getResponseCode( ) + " - " );
                System.out.println( connection.getResponseMessage( ) );
                BufferedReader in = new BufferedReader(new InputStreamReader(connection.getInputStream()));

                StringBuilder builder = new StringBuilder( );
                String line = "";

                while( ( line = in.readLine( ) ) != null )
                   builder.append( line + '\n' );
                System.out.println( builder.toString( ) );
            } catch ( IOException ioExc )
                System.out.println( "IOException while opening connection" );
            } finally
                //out.close( );
        } catch ( MalformedURLException exc )
            System.out.println( "URL is malformed." );
        return "";

2 Answers 2


Your re-direction url would work if the following conditions are met:

  1. the computer in front of you is directly connected to the internet without restrictive firewalls blocking incoming access on port 8443.
  2. you're currently running an application (locally) that is listening on port 8443.
  3. salesforce magically knew how to route your request back to your computer.

There are a number of services that allow you to "pin" your IP to a domain. Services like no-ip.com, dyn-dns.com etc. If you register for one of those services, you'll end up with a domain you can use to replace localhost. This allows Salesforce to route your callback back to you. Once you've registered with such a service, be sure to keep the ip up to date.

Note, you'll still face firewall restrictions


A "Connected App" in a Salesforce org (shown at the bottom of the Setup -> Create -> Apps page) defines a client secret used to verify an authentication request and specifies the callback URL that will be invoked from Salesforce when the user has logged in successfully. (I'm not sure how this related to your "SalesForce REST authentication page" but by the looks of the request you are using OATH2. I'm not familiar with RuneScope.)

The callback URL has to be an internet accessible and expect the OAUTH2 response. The fact that yours is set to localhost is not good because Salesforce cannot connect to that. You may be able to open a firewall to allow Salesforce to callback or if that isn't possible you may have to run the Java code out in the cloud e.g. on Heroku.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .