I have issue with Salesforce Rest API. I've created developer account and created service application which called Salesforce through Rest API and it worked, but as I changed to production Salesforce site, the calling started failing with error code 400 for a bad request. Do you know why could it be ? all the data I am passing should be right.

var authClient = new HttpClient();
HttpContent content = new FormUrlEncodedContent(
    new Dictionary<string, string>{
        {"password", Password+SecurityToken}
JObject obj = null;
HttpResponseMessage message = authClient.PostAsync(

Error from request:
"error_description": "authentication failure", "error": "invalid_grant"

And if I call from server directly (I added its IP as exception):
{"error_description":"grant type not supported","error":"unsupported_grant_type"}

Edit: It is most likely problem with IP restrictions, how could I manage bypass it without removing these restrictions completely?

2nd Edit It seems it was only half of the problem, as new environment is sandboxed authentication url must be different. How to know that url, and does connection depend on connected app callback url setting? If so how to set it properly?

1 Answer 1


If this is caused by the IP restrictions as you have indicated you could change the configuration of your connected App to "Relax IP restrictions".

As per the docs: "Relax IP restrictions: A user running this connected app is not subject to any IP restrictions."

If you don't want to compromise the security of your application you could add the IP address from where your application connects from to the list of IP addresses you trust, of course, this would only work if you have a static IP address.

  • But wouldn't it be big security breach?
    – Vilius
    Jun 3, 2015 at 13:00
  • I have updated my answer.
    – PepeFloyd
    Jun 3, 2015 at 13:07
  • I've tried that, it'seems worked but now I have with different error unsupported_grant_type
    – Vilius
    Jun 3, 2015 at 13:14
  • Plus it worked only if I do calls directly from that server
    – Vilius
    Jun 3, 2015 at 13:37
  • If you add that server to the accepted IPs list, it makes sense that it would only work from that server. It could be a small security hole if someone were to spoof that IP, but first they would need to know which IP to spoof, which could be more difficult to ascertain. Also, your authentication method means they would also need credentials, as well as a spoofed IP, so you still have two layers of security. Jun 3, 2015 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .