I have issue with SalesForce Rest API. I've created developer account and created service application which called SalesForce through Rest API and it worked, but as I changed to production SalesForce site, the calling started failing with error code 400 for a bad request. Do you know why could it be ? all the data I am passing should be right.

var authClient = new HttpClient();
HttpContent content = new FormUrlEncodedContent(
    new Dictionary<string, string>{
        {"password", Password+SecurityToken}
JObject obj = null;
HttpResponseMessage message = authClient.PostAsync(

Error from request:
"error_description": "authentication failure", "error": "invalid_grant"

And if I call from server directly (I added its IP as exception):
{"error_description":"grant type not supported","error":"unsupported_grant_type"}

Edit: It is most likely problem with IP restrictions, how could I manage bypass it without removing these restrictions completely?

2nd Edit It seems it was only half of the problem, as new environment is sandboxed authentication url must be different. How to know that url, and does connection depend on connected app callback url setting? If so how to set it properly?


If this is caused by the IP restrictions as you have indicated you could change the configuration of your connected App to "Relax IP restrictions".

As per the docs: "Relax IP restrictions: A user running this connected app is not subject to any IP restrictions."

If you don't want to compromise the security of your application you could add the IP address from where your application connects from to the list of IP addresses you trust, of course, this would only work if you have a static IP address.

  • But wouldn't it be big security breach? – Vilius Jun 3 '15 at 13:00
  • I have updated my answer. – PepeFloyd Jun 3 '15 at 13:07
  • I've tried that, it'seems worked but now I have with different error unsupported_grant_type – Vilius Jun 3 '15 at 13:14
  • Plus it worked only if I do calls directly from that server – Vilius Jun 3 '15 at 13:37
  • If you add that server to the accepted IPs list, it makes sense that it would only work from that server. It could be a small security hole if someone were to spoof that IP, but first they would need to know which IP to spoof, which could be more difficult to ascertain. Also, your authentication method means they would also need credentials, as well as a spoofed IP, so you still have two layers of security. – Lee Harrison Jun 3 '15 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.