I need to call an exposed Apex class in my dev org from the post install script. This post install script will run on the installation of the managed package on a clients org and will send the package version, org id of the client org and company name to the Apex class by making a REST call. The Apex class will save this info in a custom object.


global with sharing class LicenseManager {

    global static void recordPackageInstall(String orgId, String packageVersion, String cmpName) {
         //my code

In my post install script I plan to call it like this

HttpRequest req = new HttpRequest();
HttpResponse res = new HttpResponse();
Http http = new Http();

req.setBody('{"orgId":"1234", "packageVersion":"2.3", "cmpName":"My Client"}');
res = http.send(req);

How do I create a authorization token? I am following this link : http://www.salesforce.com/us/developer/docs/api_rest/index_Left.htm#StartTopic=Content/quickstart.htm

and it tells me to create a connected app in my instance salesforce org and use the generate key as authorization token. But I am confused on how it is to be used.

Do I use the consumer key? Do I use the consumer secret? How do I use it?

I tried something like this:

req.setHeader('Authorization', 'OAuth ' + accessToken);

where String accessToken = 'consumer key';

But it gives me Status = Unauthorized and code 401.

What am I doing wrong?

  • Are you trying to call this code in your own org, or in the client's installed org? The client key and secret are used as part of the OAuth mechanism. You still need to provide a valid access token, which is obtained by logging in, refreshing from a refresh token, or even getting a normal, SOAP-based session ID. I can't imagine this is going to be terribly easy to implement repeatably.
    – sfdcfox
    Commented Mar 17, 2015 at 23:32
  • For now to test I am calling the code from the dev console of my clients org. I want to check if it works. Commented Mar 18, 2015 at 13:02

1 Answer 1


I'm not even sure this is possible with OAuth. If I were you, I would expose the Apex REST Method for unauthenticated access (see Quick Tip – Public RESTful Web Services on Force.com Sites), and pass some shared secret in an HTTP header. You can put the shared secret in a custom setting in the managed package, so it's not accessible to the customer), and test for it in the REST method in your dev org.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .