56 votes
Accepted

Use a Named Credential with API key?

Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named ...
sfdcfox's user avatar
  • 481k
27 votes
Accepted

Mavensmate: Getting error client identifier invalid while authentication to salesforce

To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce. MavensMate's codebase has ...
Joe Ferraro's user avatar
20 votes
Accepted

Pros and cons of user-agent flow vs web server flow

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
sfdcfox's user avatar
  • 481k
17 votes
Accepted

What is "Sfdx Auth Url" attribute used for?

The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential. In fact it is the easiest way to authenticate through CLI. ...
Mohith Shrivastava's user avatar
11 votes

error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration

I had the same problem. I found that callback url in the connected app should be the same as you have in your redirect_uri. I tested it with a tool called postman, maybe that can help you as well.
ChristianJuul's user avatar
10 votes

Two factor authentication for Community Users

Two Factor Authentication is supported for Community Users as pointed out by Rob Cowell. For standard user license type, you my be accustomed to enabling 2FA via the System Permission Two-Factor ...
Doug Ayers's user avatar
  • 4,156
9 votes
Accepted

How can I avoid Salesforce expiring my password and/or token without warning?

Your token didn't expire, your password did. As an administrator, you can make a Permission Set with the Password Never Expires permission, and assign it to your user account (affects only yourself), ...
sfdcfox's user avatar
  • 481k
9 votes
Accepted

Salesforce Server-To-Server API authentication

I believe the JWT Bearer OAuth 2.0 flow is the way to go here. There is some setup involved (you need to generate/use an X509 certificate, use the user-agent or web-server flows to authorize once), ...
Derek F's user avatar
  • 59.3k
9 votes

Mavensmate: Getting error client identifier invalid while authentication to salesforce

MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see. There is the chance it could ...
gelliott181's user avatar
8 votes

Facebook as Auth Provider - no username or email passed in Auth.Data

Fill the field 'User Info Endpoint URL' (on Auth provider page ) with this and test it out. https://graph.facebook.com/me?fields=first_name,last_name,email Reason for suggestion is: Facebook api v2....
Sergio Valle's user avatar
8 votes
Accepted

Is there a better way to do two-factor authentication?

There's two main ways to use 2FA. The first is where you enter a code each time you log in, and the second is where you authenticate the login through a mobile app. If you install the Salesforce ...
sfdcfox's user avatar
  • 481k
7 votes
Accepted

How do I authorize access to a managed application in another org?

I just went through something similar where the final destination varied depending on the customer so a static callback int he code did not work. What I did on our LMA org to handle this was: Placed ...
Eric's user avatar
  • 54k
7 votes
Accepted

How is this possible to use the Salesforce CLI after changing my user's password?

Salesforce CLI use an access token to connect to your org. This means that even if you change your password or even your username it will still be connected to your org trough your username. If you ...
gvgramazio's user avatar
7 votes

Determine whether running user is logged in from within Trusted IP Range (from Apex)

You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as ...
Brent Bowers's user avatar
  • 3,074
7 votes

Mavensmate: Getting error client identifier invalid while authentication to salesforce

As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost ...
NSjonas's user avatar
  • 10k
7 votes
Accepted

Testing Community "Passwordless Login" using the System.UserManagement Class

I think the sad truth is that there is currently (as at v47.0) no support in Apex for testing those methods or the corresponding TwoFactorMethodsInfo API. I'm asking around for verification, but the ...
Daniel Ballinger's user avatar
6 votes

Two factor authentication for Community Users

At the time of writing (Mar 2016), I believe Two-factor is available for Community Users, based on what I'm seeing at https://help.salesforce.com/HTViewHelpDoc?id=two_factor_auth_for_sso_and_saml.htm&...
Rob Cowell's user avatar
6 votes
Accepted

When to use username & password flow to obtain a token

The username-password flow is only intended for development. It is insecure and should never be used for a production application. As this help topic helpfully warns: This OAuth authentication flow ...
sfdcfox's user avatar
  • 481k
6 votes
Accepted

Using basic http authentication to authorize connection

You can't use Basic Authentication with Salesforce. Instead, use the SOAP login() call or the OAuth Username-Password authentication flow.
sfdcfox's user avatar
  • 481k
6 votes
Accepted

Sandbox verification emails

Have a look at the SandboxPostCopy Interface. It should be possible to have Apex run after the Sandbox is created and then modify the specific User records email address fields.
Daniel Ballinger's user avatar
6 votes

What method to use in a batch apex in order to get authentication token from a remote server?

I just had a similar requirement that I'm filling by using Platform Cache to hold the token and its expiration timestamp. It looks basically like this: public class WSAuthentication { public ...
Thomas Taylor's user avatar
6 votes
Accepted

How does a website that accesses my salesforce metadata/data authorize against my org?

Connected Apps are "global metadata". They don't need to be present in the target org, just in a single, persistent org that you control. If you maintain that Connected App in your own org, you can ...
David Reed's user avatar
  • 92.1k
5 votes

OpenID Connect with custom IdP: AuthorizationError: No_Oauth_Token/Empty Response

Just wanted to note that I've managed to acquire a response from Salesforce's support. They confirmed that in their current implementation of OpenID Connect client it will reject self-signed ...
Taipen's user avatar
  • 81
5 votes

Accessing Named Credentials' data in apex

One option is to use Merge Fields for Apex Callouts That Use Named Credentials. This won't explicitly give you access to the data from the named credential in Apex, but it will allow you to alter how ...
Daniel Ballinger's user avatar
5 votes

[API][CORS] Not able to use API despite domain being whitelisted

It seems you're trying to authenticate using the CORS request which isn't supported - see this comment for more details. You should be able to use it for any other API requests though - that will also ...
Gaurav Kheterpal's user avatar
5 votes
Accepted

"Unable to resolve request into a Service Provider" return by Salesforce Identity Provider for SAML 2.0 request

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's ...
ceiroa's user avatar
  • 1,029
5 votes

Two factor authentication for Community Users

You are correct, Two-Factor Authentication is not available for users with a Partner Community or Customer Community license. However, there is a no-code workaround: you can implement Two-Factor ...
zachelrath's user avatar
  • 9,523
5 votes

Using SAML to authenticate user for a force.com site

If I understand your question correctly, this should be the approach you should be following. Force.com sites do support SSO using SAML. You need to provide the following info for your identity ...
Gaurav Kheterpal's user avatar
5 votes
Accepted

Server to Server JWT Authentication Certificate management

The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow. Setup: Setup the App, get the required client_key and client_secret Build > Create > Apps Create a new Keypair ...
LoG's user avatar
  • 161
5 votes

REST API server-to-server communication

I would rather use the OAuth 2.0 JWT Bearer Token Flow. The only prerequisite is to have on both servers the same certificate for: at your server side, sign the request using the private key of ...
yutanpo's user avatar
  • 71

Only top scored, non community-wiki answers of a minimum length are eligible