Questions tagged [oauth2]

OAuth 2.0 is the next evolution of the OAuth protocol and is not backwards compatible with OAuth 1.0. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices.

Filter by
Sorted by
Tagged with
67 votes
2 answers
32k views

Connected App - avoiding a limit on a number of issued tokens + token expiration

We have configured our web application to use OAuth2 with our SFDC Connected App. The connected app is configured to never expire the refresh token unless manually revoked. When an admin connects the ...
user avatar
  • 1,325
7 votes
1 answer
4k views

Named Credentials - What is the difference between JWT & JWT Token Exchange

When setting up a named credential with Identity Type as Named Principal, two options are shown for JWT : JWT & JWT Token Exchange Could anyone explain what is the difference between the two? ...
user avatar
  • 1,295
14 votes
2 answers
1k views

Initiate an oAuth flow via an Auth Provider

I use the Metadata API and the Apex wrapper to create an AuthProvider and NamedCredential after the installation of my managed package app. MetadataService.NamedCredential cred = new MetadataService....
user avatar
15 votes
3 answers
44k views

OAuth Access Token Expiration

I have read many places that the access token session length is controlled by the client application and will expire "from time to time", but I cannot find a way for my application to calculate the ...
user avatar
  • 1,357
1 vote
1 answer
1k views

OAuth 2.0 User-Agent flow, why is it okay to keep the refresh token when it is considered unable to protect the secret

When I read the oauth 2.0 flows, the user-agent flow states itself to be used when the application is unable to protect the secret. But in the user-agent flow it is okay to have a refresh token ...
user avatar
  • 12.7k
4 votes
1 answer
1k views

Salesforce to Xero integration using Named Credentials by OAuth 2.0

I am trying to do the integration between Salesforce and Xero by using Named Credentials (Authentication Protocol is OAuth 2.0). I created an Auth provider - Then created Named credentials of OAuth 2....
user avatar
  • 372
19 votes
2 answers
5k views

Named Credentials and support for the OAuth2 Client Credentials Grant Type and alternatives

I have a requirement to authenticate to an external API for callouts using the OAuth2 Client Credentials Grant (This was helpful in referencing the different grant types for me). I would like to use ...
user avatar
27 votes
1 answer
10k views

Differences between OAuth Web Server Flow, User-Agent Flow, Username-Password Flow?

The steps for Web Server flow, Username-Password Flow, and User-Agent Flow are different, so which occasions are these three used in and how do I select any particular method for different ...
user avatar
16 votes
4 answers
11k views

Connect apex and Google API using JWT to retrieve Oauth 2.0 token

I have been trying to connect Salesforce and Google API using server to server application. Intent :- To communicate data between Salesforce and Google Spreadsheet which is hosted in Google Sites ...
user avatar
  • 3,132
9 votes
1 answer
1k views

How is it that some OAuth-authenticated apps don't require an Org to create a Connect App in order to be installed?

As far as I can tell from the documentation you are required to created a Connected App (ex-Remote App) in order to use salesforce as the authentication authority. However there are apps that don't ...
user avatar
  • 2,126
8 votes
3 answers
5k views

Pros and cons of user-agent flow vs web server flow

After looking into the different OAuth types and reading this question, I'm still confused on the specific pros and cons of user-agent vs web server flows. The best explanation I can find says that ...
user avatar
  • 979
22 votes
7 answers
32k views

Salesforce JWT User Hasn't Approved This Consumer (Again)

I know others have asked this question.  The previous solutions have not worked.  Using the OAuth JWT flow.  All Users Can Authorize is selected  User authorized via https://login.salesforce.com/...
user avatar
  • 481
8 votes
1 answer
678 views

Is it possible to programmatically change connectedApp settings in production?

Background: I have a requirement to make it so that an SFDC connected app defaults/is super easy to set to Admin Users are Pre-authorized instead of All users may self-authorize. This setting is ...
user avatar
10 votes
2 answers
27k views

OAuth2 token request using JSON fails - grant type not supported

I'm building a small application in Go that will access Salesforce using REST. I chose to use the full OAuth webflow. Documentation for the Web Server Authentication Flow I'm able to do the full ...
user avatar
  • 710
6 votes
1 answer
4k views

Should OAuth2 with grant_type "password" work for "High Volume Customer Portal" users?

I am using the "/services/oauth2/token" end point with grant_type "password" (and with client_id, client_secret, username, password) from JavaScript code. With "IP Restrictions" set to "Relax IP ...
user avatar
  • 131k
1 vote
2 answers
2k views

Per User Named Credential and External Identity Users [duplicate]

My question is almost similar to one mentioned in 'Auth Provider with per-user Named Credential' (Auth Provider with per-user Named Credential). I am trying to authenticate and make a API call when a ...
user avatar
  • 21
28 votes
2 answers
22k views

security token vs session id vs access token

Are all of these three separate values that are only linked for the same user ? For security token I mean on value that you can take from Setup -> My Personal Information -> Reset security token. As ...
user avatar
  • 931
21 votes
4 answers
42k views

Where do I find the client id and client secret of an existing connected app?

Where do I find the client id and client secret of an existing connected app? The documentation talks about this information being provided when creating a new app, but what if my app already exists? ...
user avatar
5 votes
1 answer
3k views

How do I install and preauthorize app so I can use the JWT Bearer token flow?

I'm trying to follow the instructions in https://help.salesforce.com/articleView?id=remoteaccess_oauth_jwt_flow.htm&type=5 and get an invalid request with an error description of "refresh_token ...
user avatar
7 votes
1 answer
347 views

Is OAuth 2.0 User-Agent Flow truly an Implicit Grant Type?

Is the Salesforce User-Agent Flow truly an "Implicit" grant type? It can most definitely issue a refresh token. And yet per RFC 6749 Section 4.2 Implicit Grant documentation... The implicit ...
user avatar
  • 2,101
5 votes
1 answer
6k views

How to connect to Salesforce REST API without OAuth? How does Jitterbit do it?

So what I read everywhere is that, in order to connect to Salesforce via the API, you'll have to authenticate using OAuth. But this involves creating a Connected App, which is 'cumbersome' for normal ...
user avatar
5 votes
2 answers
11k views

OAuth 2.0 Username-Password Flow Problem - unsupported_grant_type

I am trying to implement OAuth 2.0 Username-Password Flow and below is my code and debug log - any help is appreciated. Http httpProtocol = new Http(); HttpRequest request = new HttpRequest(); ...
user avatar
2 votes
1 answer
4k views

When to use username & password flow to obtain a token

One of ways to get an access_token to use with SFDC Rest Api is to use the Username and password flow, where you use both of these to get an access_token. Its documented here: https://developer....
user avatar
  • 131
4 votes
1 answer
2k views

Using Named Credentials in OAuth 2 authentication (grant_type=password)

I want to get an access token from an external endpoint (HTTP callout to REST API) without hardcoding passwords. The external system expects a request with Oauth 2.0 authentication details provided in ...
user avatar
  • 43
3 votes
1 answer
460 views

Overriding the final destination of the OAuth2.0 flow from a custom OAuth2.0 Auth provider

Background: I have created a custom Auth. Provider in Salesforce to reach out to an authorization server that isn't on the default list of Provider Types. I used https://developer.salesforce.com/docs/...
user avatar
1 vote
1 answer
1k views

OpenID Connect - adding custom attributes (claims) to id token

I'm having trouble getting a custom claim attribute to come through in the id_token. I've got the scope set to openid and I've added the custom attribute to the Connected App (tenantId). I also tried ...
user avatar
  • 330
9 votes
2 answers
5k views

Does Salesforce support the Client Credentials Grant for OAuth?

For every API I'm consuming from Salesforce so far, I'm using the Client Credentials Grant for everything that's just between servers (= no user involved). It seems that Salesforce itself does not ...
user avatar
  • 2,006
6 votes
2 answers
2k views

Custom Auth Provider usage for unattended OAuth flow

I am attempting to make a REST callout to an API in our company that uses ApiGee as the OAuth2 provider using a simple client credentials grant type. Open-ID is not enabled and will likely not be an ...
user avatar
  • 121
3 votes
3 answers
1k views

How to integrate JIRA with salesforce using OAuth 2.0 [closed]

I am banging my head against the wall from the last couple of weeks to just set up the authentication between JIRA cloud and salesforce, I didn't get any proper documentation to create a connected ...
user avatar
  • 2,270
3 votes
1 answer
2k views

OAuth implementation in SOAP API (C#) [closed]

I would like help how I can append Soap Header with following header in C#. Currently we are passing user credentials in the header. I need a help how we can replace with FuelOauth node in C#? As per ...
user avatar
  • 337
2 votes
1 answer
146 views

How does a website that accesses my salesforce metadata/data authorize against my org?

I am attempting to create a web app (ruby on rails) that requires access to a user's Salesforce environment to perform some REST api calls (SOQL queries) and in doing so I've implemented the web ...
user avatar
13 votes
2 answers
2k views

OAuth interactions: do they count as API calls?

OAuth token grants and token authorizations are human interactions that take place in the browser. And token refreshes happen to be machine interactions. Do any of the typical OAuth interactions count ...
user avatar
6 votes
1 answer
5k views

Has anyone got the OAuth 2.0 JWT Bearer Token Flow to work initiated from Apex code now 'RSA-SHA256' signing is available?

This year old thread Connect apex and Google API using JWT to retrieve Oauth 2.0 token was started before the Crypto class included the 'RSA-SHA256' signing algorithm. Now that this algorithm is ...
user avatar
  • 131k
5 votes
1 answer
20k views

Best way to get Session ID or oAuth Access Token

What is the best way to get Session ID or oAuth Access Token, without having to use password in Apex Code (or) in custom settings (or) Named Credentials? Will one of the oAuth flows work in this case?...
user avatar
  • 1,295
5 votes
1 answer
14k views

{"error":"invalid_grant","error_description":"authentication failure"}

I know this must have been posted here and I've tried the solutions I've searched across the web but I am still getting the error {"error":"invalid_grant","error_description&...
user avatar
4 votes
1 answer
1k views

Unable to create a Connected App: "The application name has been used before" even when it has not

I managed to add a connected app in a sandbox instance but when I try to add one in the production instance, I receive this error. The application name [name] / [API name] has been used before. Use ...
user avatar
  • 51
4 votes
1 answer
2k views

Is it possible to set per user Named Credentials via Apex?

I need to integrate with an external system that cannot fully support OAuth 2.0 server flow, so we're looking at just doing a basic username/password flow. So, I think I need to set up Named ...
user avatar
  • 12.9k
2 votes
2 answers
12k views

Obtain enterprise WSDL via curl

I am trying to obtain enterprise WSDL by accessing https://cs15.salesforce.com/soap/wsdl.jsp?type=* URL via curl. For this, I have obtained access token through OAUTH2 method via the following curl ...
user avatar
  • 351
2 votes
2 answers
649 views

SSJS OAuth 2 Support?

I'm trying to obtain an OAuth 2 token through SSJS and getting a 400 error. Here's the code I'm using: <script type="javascript" runat="server"> Platform.Load("Core", "1.1.5"); var ...
user avatar
  • 420
1 vote
1 answer
2k views

How to provide access to Salesforce REST API to external application without providing them Integration user credentials?

Our salesforce org needs to expose some functionality as a REST API class to an external app. We created the apex class(@RestResource(urlMapping='')), now to provide access to the external app : We ...
user avatar
  • 2,223
6 votes
2 answers
2k views

oAuth - Introspection endpoint says a valid access token is inactive

I'm new to salesforce and I'm trying to obtain a access token with password grant, I can successfully obtain the access token: Request: POST /services/oauth2/token HTTP/1.1 Host: .....my....
user avatar
  • 63
4 votes
2 answers
561 views

Cannot authorize a Scratch Org via JWT - invalid_grant - user hasn't approved this consumer

I've followed the docs here to create a cert and configured the following; OAuth scopes: api, refresh_token, offline_access and web Permitted users: Admin approved users are pre-authorized Profiles: ...
user avatar
4 votes
1 answer
5k views

Getting "unsupported_grant_type" error when using Angular.JS app + ExpressJS proxy

I know there's already a lot of discussion around the "unsupported_grant_type" error that occurs when using the Username/Password Authentication Flow, but I've exhausted through all other proposed ...
user avatar
4 votes
3 answers
7k views

OAuth 2.0 access token request failed with error "must use HTTP POST"

OAuth 2.0 Auth token request failed with below error { "error": "invalid_request", "error_description": "must use HTTP POST" } What does this error mean? I am using Postman. Have a connected app. ...
user avatar
  • 663
3 votes
2 answers
1k views

How to use OAuth only for login, not create account unless the user wants one

I have a lovely OAuth setup so people can use facebook to register for my force.com site. It works great for new users, or for existing users where facebook email matches their account. There's ...
user avatar
3 votes
1 answer
490 views

Oauth throws "invalid_grant: user hasn't approved this consumer" randomly for Community Login profile

I have an OAuth JWT Bearer token flow set up like this: Admin approved users are pre-authorized all profiles added to approved list Relax IP restrictions api, refresh_token/offline_access oauth ...
user avatar
1 vote
1 answer
145 views

How do I contextualize the Fuel SDK to retrieve event data for a specific user?

Is it possible to get the Ruby FuelSDK to query for, say, the subscribers or events of another user who has installed an app? Do I simply need to set the internal_token? fuelsdk_client = FuelSDK::...
user avatar
1 vote
1 answer
175 views

Customer.io: webhook access_token update

I'm trying to create a webhook from customer.io that will connect to Salesforce via the REST api. As part of that, I need to grab the access_token. This is fine for a while, but the token will ...
user avatar
  • 977
1 vote
0 answers
279 views

Salesforce Marketing cloud rest API from Salesforce Cloud (apex)

I'm trying do set Auth. Providers and Named Credential for the salesforce marketing cloud in order to be able to make callout from apex without worrying to get and refresh the token. Is there any ...
user avatar
  • 11
0 votes
1 answer
477 views

Retrieving oAuth scopes from an installed connected app

In the portal, it is easy under the setup console, find a specific application, and see all of its Application Permissions. For example: However, when querying the API for ConnectedApplications, ...
user avatar