Questions tagged [oauth2]

OAuth 2.0 is the next evolution of the OAuth protocol and is not backwards compatible with OAuth 1.0. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices.

Filter by
Sorted by
Tagged with
63
votes
2answers
25k views

Connected App - avoiding a limit on a number of issued tokens + token expiration

We have configured our web application to use OAuth2 with our SFDC Connected App. The connected app is configured to never expire the refresh token unless manually revoked. When an admin connects the ...
27
votes
2answers
17k views

security token vs session id vs access token

Are all of these three separate values that are only linked for the same user ? For security token I mean on value that you can take from Setup -> My Personal Information -> Reset security token. As ...
27
votes
1answer
47k views

What's the benefit of the client secret in OAuth2?

In the OAuth 2.0 "Web Server" flow you are required to have a client secret, whereas in other flows you aren't. I can't find an explicit statement as to why you'd need to have a client secret. Is the ...
26
votes
1answer
9k views

Differences between OAuth Web Server Flow, User-Agent Flow, Username-Password Flow?

The steps for Web Server flow, Username-Password Flow, and User-Agent Flow are different, so which occasions are these three used in and how do I select any particular method for different ...
18
votes
2answers
2k views

How workbench is able to log into Salesforce with OAuth

I have been trying to fiddle with OAuth user-agent flow and understand that you need to have a connected app defined in Salesforce. You would then use the client secret from that in your app to be ...
16
votes
3answers
24k views

Where do I find the client id and client secret of an existing connected app?

Where do I find the client id and client secret of an existing connected app? The documentation talks about this information being provided when creating a new app, but what if my app already exists? ...
16
votes
2answers
13k views

OAUth Issue: OAuth_Approval_Error_Generic

So I'm using the iOS Mobile SDK. I had an app working without issue, then changed the Consumer key to that of a different connected app (i.e. changed away from the default sample one) and updated the ...
15
votes
4answers
8k views

Connect apex and Google API using JWT to retrieve Oauth 2.0 token

I have been trying to connect Salesforce and Google API using server to server application. Intent :- To communicate data between Salesforce and Google Spreadsheet which is hosted in Google Sites ...
14
votes
4answers
2k views

Why Salesforce.com logs the user in automatically after his/her session has been invalidated?

I'm logging in users via REST in my .NET application. For that in the WebBrowser control constructor I do the following: string server = "https://login.salesforce.com/"; var authURI = new ...
13
votes
3answers
27k views

OAuth Access Token Expiration

I have read many places that the access token session length is controlled by the client application and will expire "from time to time", but I cannot find a way for my application to calculate the ...
13
votes
2answers
2k views

Named Credentials and support for the OAuth2 Client Credentials Grant Type and alternatives

I have a requirement to authenticate to an external API for callouts using the OAuth2 Client Credentials Grant (This was helpful in referencing the different grant types for me). I would like to use ...
13
votes
3answers
14k views

Salesforce JWT User Hasn't Approved This Consumer (Again)

I know others have asked this question.  The previous solutions have not worked.  Using the OAuth JWT flow.  All Users Can Authorize is selected  User authorized via https://login.salesforce.com/...
13
votes
1answer
4k views

Using Named Credentials and Auth Provider to manage security token for APEX Callout to an OAuth 2.0 REST API

I'm trying to do an APEX Callout to a OAuth 2.0 secured REST API This is the API https://developers.pandadoc.com/v1/reference#authentication-process I want to use something to manage the security ...
12
votes
2answers
473 views

Initiate an oAuth flow via an Auth Provider

I use the Metadata API and the Apex wrapper to create an AuthProvider and NamedCredential after the installation of my managed package app. MetadataService.NamedCredential cred = new MetadataService....
12
votes
2answers
944 views

OAuth interactions: do they count as API calls?

OAuth token grants and token authorizations are human interactions that take place in the browser. And token refreshes happen to be machine interactions. Do any of the typical OAuth interactions count ...
11
votes
0answers
2k views

Including access token in endpoint URL when using named credential in REST callout

I'm trying to retrieve a list of forms using the FormAssembly API via a HTTP Request to the endpoint: https://app.formassembly.com/api_v1/forms/index.json I was able to setup named credentials and ...
10
votes
2answers
23k views

OAuth2 token request using JSON fails - grant type not supported

I'm building a small application in Go that will access Salesforce using REST. I chose to use the full OAuth webflow. Documentation for the Web Server Authentication Flow I'm able to do the full ...
10
votes
1answer
421 views

Salesforce to Salesforce Oauth Webserver flow? Is it possible?

Is it possible to integrate Salesforce to Salesforce using Oauth Webserver flow? I cannot use the standard S2S(Salesforce to Salesforce) feature due to certain limitation. I basically sync data from ...
10
votes
2answers
2k views

How to do oAuth within Visualforce and be redirected back to the visual force page

FINAL* Ok, so first lesson, do not stay up to late Second for those that may need: First URL needs to end in authorization This returns a CODE the second needs to be an HTTPRequest with response ...
9
votes
1answer
986 views

How is it that some OAuth-authenticated apps don't require an Org to create a Connect App in order to be installed?

As far as I can tell from the documentation you are required to created a Connected App (ex-Remote App) in order to use salesforce as the authentication authority. However there are apps that don't ...
8
votes
3answers
4k views

“Session expired or invalid” problem calling an @RestResource from Apex in Winter '15 preview; UserInfo.getSession returns null for Force.com Sites

Based on threads such as Calling Apex Rest custom web service from Apex code we have HTTP calls in our Apex code (contained in a managed package) back to the same org authorized like this: ...
8
votes
3answers
8k views

What's the difference between these authentication endpoints?

Based on the information in the Salesforce rest-API documentation, examples of valid restful endpoints for authentication are: For authorization: https://login.salesforce.com/services/oauth2/...
8
votes
1answer
1k views

Prevent auto-authenticate using OAuth 2.0 Web Server Flow?

We're trying to override the auto-authenticate behavior when kicking off a web server flow in the REST API. Basically, we need to let a user authenticate and capture OAuth tokens to several Salesforce ...
8
votes
1answer
254 views

Is it possible to programmatically change connectedApp settings in production?

Background: I have a requirement to make it so that an SFDC connected app defaults/is super easy to set to Admin Users are Pre-authorized instead of All users may self-authorize. This setting is ...
8
votes
1answer
895 views

How to further limit OAuth API scope access

We have a connected app configured and working. We have a web server oauth flow setup and have configured "api" and "refresh token / offline access" as the oauth scope. We also created a separate ...
8
votes
1answer
191 views

OAuth Connected App without Identity Provider Enabled

Working on a project where the client wants to be able to use OAuth to login to an external website backend. The documentation for setting up OAuth doesn't actually mention enabling the IDP so I'm ...
8
votes
1answer
11k views

Using Java and Spring to integrate with Salesforce REST APIs

I want to send information from our webapp (using Java and Spring) to the Salesforce REST APIs. I'm looking for an up-to-date example of how to use Spring Security to authenticate with OAuth to the ...
8
votes
1answer
1k views

Can I use an OAuth 2.0 token for API Integration in Enhanced Packages in the Soap API fueloauth token header

In Salesforce marketing cloud I have an installed package with an API integration. I am in the process of moving from the old OAuth token created via https://auth.exacttargetapis.com/v1/requestToken ...
8
votes
2answers
3k views

How do I get an OAuth2 refresh token in Google Chrome Packaged Apps?

Background I am creating a Google Chrome Packaged App that allows users to access various features from a plurality of salesforce.com organizations. This app will allow users to perform various tasks ...
8
votes
2answers
3k views

OAuth 2.0 JWT Bearer Token Flow - “user hasn't approved this consumer”

I am trying to get JWT Bearer Token Flow to work. But get the error user hasn't approved this consumer. I have read these posts: Salesforce JWT User Hasn't Approved This Consumer (Again) OAuth 2....
7
votes
2answers
4k views

Pros and cons of user-agent flow vs web server flow

After looking into the different OAuth types and reading this question, I'm still confused on the specific pros and cons of user-agent vs web server flows. The best explanation I can find says that ...
7
votes
4answers
30k views

{“error”:“unsupported_grant_type”,“error_description”:“grant type not supported”}

I am getting the below error when trying to call the HTTP POST using the Apex Http http = new Http(); HttpRequest request = new HttpRequest(); request.setEndpoint('https://ap5.salesforce.com/services/...
7
votes
1answer
3k views

How do I see/change the Oauth2 callback URL for a connected app?

I created the connected app and everything is working fine. I am able to generate Oauth2 tokens and query objects. However if want to see/change the Oauth2 details like callback URL, I cannot see it ...
7
votes
1answer
14k views

OAuth2 Refresh Token Flow - Unsupported Grant Type [duplicate]

I am attempting to obtain a token, using the Oauth 2 refresh token flow. I am using the REST Console in Chrome to perform the following POST operation: My URI is https://cs11.salesforce.com/...
7
votes
2answers
5k views

Is it possible to store and reuse a refresh token ad infinitum?

I want to be able to insert records into a custom object on behalf of users from my web app without their direct involvement aside from their initial granting my app permission to do so. The events ...
7
votes
2answers
3k views

REST API server-to-server communication

I'm writing an application that needs to connect and grab some data from Salesforce. Data will be pulled by a background script (no UI) and then populated in a web UI. I can't find anything ...
7
votes
2answers
1k views

Multiple connected apps using OAuth

We have a Node.js application whose web page is exposed as a canvas app on Salesforce. This shows the web page on Salesforce and allows users to make visual changes to it (one of our requirements). ...
7
votes
1answer
1k views

Session Id not getting refreshed automatically with Custom Auth provider in Salesforce Named Credentials

Problem statement : The Named Credential created for OAuth 2.0 authentication and Custom Auth provider works until the first session Id which was obtained using the method 'handleCallback' is valid. ...
7
votes
1answer
6k views

INVALID_SESSION_ID: This session is not valid for use with the API, when calling SOAP API in old fashion

I have registered connected application with partner's SalesForce on Partner API level. Connected app have defined following scopes (id, web, api and refresh_token). When I try to invoke SOAP API ...
7
votes
1answer
3k views

Fetch image from Rich Text Field

I have built an export/import tool for Knowledgebase articles using Partner API. Everything works fine, the only functionality I can't produce is the ability to export images, hence obviously I can't ...
7
votes
1answer
1k views

Get user's info on login into Salesforce org with OpenID Connect

As per the winter'14 feature OpenID Connect, I have successfully logged-in salesforce but I not getting enough user information like I was able to do in Facebook auth. While facebook auth provided a ...
7
votes
1answer
441 views

OAuth 2.0 handshake for Portal users

As described on OAuth for portal , initial OAuth handshake for authorization code gathering is changed. It should be used different domain URL Like, instead of : https://login.salesforce.com/...
7
votes
1answer
4k views

REST API: “INVALID_SESSION_ID” with valid token

I'm having some trouble accessing API endpoints using a valid token that I just got from the OAuth process. I'm passing data as I think I should and am trying to access any endpoint at this point (...
7
votes
1answer
1k views

How do I get the user details when authenticating with OAuth 2.0?

I am using DotNetOpenAuth libraries to implement OAuth 2.0 client side to communicate with SalesForce authorization server. I have finished first two steps of OAuth 2.0 communication that ends with ...
7
votes
1answer
1k views

How to authenticate a JavaScript (e.g. AngularJS) client of an Apex @RestResource?

I am working on an AngularJS mobile application that obtains its data from salesforce.com using REST calls to @RestResource Apex classes. (There are no conventional Visualforce/Apex controller pages.) ...
7
votes
0answers
278 views

Loading Static Resources When Accessing a Page WIth an OAuth Access Token

If you specify the 'web' scope for a connected app it's supposed to grant/provide access to Visualforce pages. I'm authenticating via the iOS mobile SDK and then attempting to use the access token I ...
6
votes
1answer
5k views

Authentication Failure when submitting Authorization Code in OAuth Web-Server Flow

I am trying to test the Webserver OAuth as described here I can get the authorization code successfully by opening https://login.salesforce.com/services/oauth2/authorize?response_type=code&...
6
votes
1answer
4k views

Has anyone got the OAuth 2.0 JWT Bearer Token Flow to work initiated from Apex code now 'RSA-SHA256' signing is available?

This year old thread Connect apex and Google API using JWT to retrieve Oauth 2.0 token was started before the Crypto class included the 'RSA-SHA256' signing algorithm. Now that this algorithm is ...
6
votes
1answer
4k views

OAuth API doesn't send refresh token with custom redirect_uri

If I put this link in my web browser (I put them on separate lines for readability): https://login.salesforce.com/services/oauth2/authorize ?response_type=token &client_id=MY_CONSUMER_KEY &...
6
votes
1answer
4k views

Should OAuth2 with grant_type “password” work for “High Volume Customer Portal” users?

I am using the "/services/oauth2/token" end point with grant_type "password" (and with client_id, client_secret, username, password) from JavaScript code. With "IP Restrictions" set to "Relax IP ...

1
2 3 4 5
14