Org: Developer org. I faced a strange issue. I was generating the access token by providing client id, client secret, username and password. I used 2 following cURL commands :

  1. curl https://login.salesforce.com/services/oauth2/token -d “grant_type=password” -d "client_id=--client_id--" -d "client_secret=--client_secret--" -d "username=rohit_kapoor@persi.com" -d "password=pwd" .

Result : {"error":"unsupported_grant_type","error_description":"grant type not supported"}

  1. curl -d "username=rohit_kapoor@persi.com" -d "password=pwd" -d "client_id=--client_id--" -d "client_secret=--client_secret--" -d "grant_type=password" https://login.salesforce.com/services/oauth2/token

Result (success) :


Could anyone please explain why placing the SFDC url (https://login.salesforce.com/services/oauth2/token) at the end result in generation access token.

Kindly note: security token is not appended with password while generating access token as Developer org does not have this option (another strange thing)

  • 1
    You should probably reset your password now... – martin Sep 7 '15 at 8:52
  • I have already done that. Still thanks for letting me know, I will hide all these in future. – Rohit Sep 7 '15 at 8:56
  • I think curl evaluates -d flags and then URL. It's as if you have missed all the -d parameters altogether. I.e. triggering only curl https://login.salesforce.com/services/oauth2/token gives me same result {"error":"unsupported_grant_type","error_description":"grant type not supported"}. So definitely some sloppiness on Salesforce side generating wrong error messages AND on curl side skipping your parameters. – dzh Sep 7 '15 at 9:08
  • Try to append -v and see if you are getting any other details. – Saroj Bera Dec 17 '18 at 15:00

you are giving the Callback url befor the user is authorised to access his her salesforce account. Callback URL in salesforce is nothing but what Salesforce will callback with once the user authorizes access to his/her Salesforce account. Provide callback url as https://ap1.salesforce.com/services/oauth2/token

so giving the callabck url after the user is authorised provides the access token and the other information

| improve this answer | |
  • I searched the solution provided by you. But in many other blogs the command mentioned at (1) above is being used. Still I feel your reply is very near to correct reason. I will search and reply the same – Rohit Sep 7 '15 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.