Org: Developer org. I faced a strange issue. I was generating the access token by providing client id, client secret, username and password. I used 2 following cURL commands :

  1. curl https://login.salesforce.com/services/oauth2/token -d “grant_type=password” -d "client_id=--client_id--" -d "client_secret=--client_secret--" -d "[email protected]" -d "password=pwd" .

Result : {"error":"unsupported_grant_type","error_description":"grant type not supported"}

  1. curl -d "[email protected]" -d "password=pwd" -d "client_id=--client_id--" -d "client_secret=--client_secret--" -d "grant_type=password" https://login.salesforce.com/services/oauth2/token

Result (success) :


Could anyone please explain why placing the SFDC url (https://login.salesforce.com/services/oauth2/token) at the end result in generation access token.

Kindly note: security token is not appended with password while generating access token as Developer org does not have this option (another strange thing)

  • 1
    You should probably reset your password now...
    – martin
    Sep 7, 2015 at 8:52
  • I have already done that. Still thanks for letting me know, I will hide all these in future.
    – Rohit
    Sep 7, 2015 at 8:56
  • I think curl evaluates -d flags and then URL. It's as if you have missed all the -d parameters altogether. I.e. triggering only curl https://login.salesforce.com/services/oauth2/token gives me same result {"error":"unsupported_grant_type","error_description":"grant type not supported"}. So definitely some sloppiness on Salesforce side generating wrong error messages AND on curl side skipping your parameters.
    – dzh
    Sep 7, 2015 at 9:08
  • Try to append -v and see if you are getting any other details.
    – Saroj Bera
    Dec 17, 2018 at 15:00

1 Answer 1


you are giving the Callback url befor the user is authorised to access his her salesforce account. Callback URL in salesforce is nothing but what Salesforce will callback with once the user authorizes access to his/her Salesforce account. Provide callback url as https://ap1.salesforce.com/services/oauth2/token

so giving the callabck url after the user is authorised provides the access token and the other information

  • I searched the solution provided by you. But in many other blogs the command mentioned at (1) above is being used. Still I feel your reply is very near to correct reason. I will search and reply the same
    – Rohit
    Sep 7, 2015 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .