Hey guys I had a dream last night about a huge issue in our ability to aggregate data.

After setting up a remote app, using PHP to "CURL" into login.salesforce.com for authorization, we hit the Username/Password sequence. I see that this actuates frontdoor.jsp which in tern passes you to where you need to be (as long as app is accepted).

The question is how to POST through frontdoor.jsp so we will not have to manually enter a user/pass ?

I found THIS method, using http://[email protected]&pw=xxxxxxxx which works, but in order to use it, I will need to return to my script....

Without using CURL, and trying to access via

https://login.salesforce.com/services/oauth2/token?response_type=code&client_id=3MVG9A2kN3Bn17hv5JnQay9VirDF4FfYeGdVnwT0fP1AtVJoj3upT9ce7epjSmZPXsSkeX.o74fJ39Q.g9kv_&[email protected]&pw=xxxxxx&redirect_uri=https%3A%2F%2Fsm-rdc-c-dev.foo.com%2FOAuthCallback.php

give me the response error:

  <error_description>grant type not supported</error_description>

POST packet looks like this.

client_id       3MVG9A2kN3Bn17hv5JnQay9VirDF4FfYeGdVnwT0fP1AtVJoj3upT9ce7epjSmZPXsSkeX.o74fJ39Q.g9kv_
pw              xxxxxxxxxxxxxx
redirect_uri    https://sm-rdc-c-dev.foo.com/OAuthCallback.php
response_type   code
un              [email protected]

1 Answer 1


Instead of delegating to a human for credentials, you can use the Username-Password flow (where you securely store the credentials and a security token) - here's an example:

  1. Authenticate with credentials stored on your server (the response will be JSON, not frontdoor.jsp)

    $curl = curl_init();
    curl_setopt_array($curl, array(
      CURLOPT_URL            => 'https://login.salesforce.com/services/oauth2/token',
      CURLOPT_POST           => TRUE,
      CURLOPT_POSTFIELDS     => http_build_query(array(
      'grant_type'    => 'password',
      'client_id'     => '1234567890RVOvk4UFPhxrL09VocBGAf1vMcbM8cJOZUeZ0MroSMdT...',
      'client_secret' => '1234567891234567890',
      'username'      => '[email protected]',
      'password'      => 'secret' . 'SECURITYsioWgh8yZOnUtTOKEN',
    $response = json_decode(curl_exec($curl));
      'id'           => 'https://login.salesforce.com/id/00Dd01234567890/005d01234567890',
      'issued_at'    => '1359399973348',
      'instance_url' => 'https://na14.salesforce.com',
      'signature'    => '1234567890cqnL8rMv9HQX7zfdo3H3Mim1234567890=',
      'access_token' => '00Dd01234567890!AR8AQFPyjVdVPp62Q2ZlM3BG0Vm33iRJs3wMWqNuJsd...',
  2. Now use the Session ID to POST to your REST Web Service or whatever...

    $curl = curl_init();
    curl_setopt_array($curl, array(
      CURLOPT_URL            => $response->instance_url . '/services/apexrest/MyController',
      CURLOPT_POST           => TRUE,
      CURLOPT_HTTPHEADER     => array('Authorization: Bearer ' . $response->access_token),
    $response = curl_exec($curl);
  • One quick question, will this let me aggregate data from the remote app that I have?
    – ehime
    Commented Feb 7, 2013 at 19:51
  • great question -- can you make a new post briefly outlining what you're doing, eg screen scrape etc? Commented Feb 7, 2013 at 21:17
  • added question: salesforce.stackexchange.com/questions/8255/…
    – ehime
    Commented Feb 8, 2013 at 16:36
  • Is there a way to do this when requesting a code? I tried https://login.salesforce.com/services/oauth2/authorize?response_type=code&[email protected]&password=xxxxxxxxxxxxxxx&client_id=xxxxxxxxxxxxxx&redirect_uri=https://domain.com/callback.php to no avail =(
    – ehime
    Commented Feb 8, 2013 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .