Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
56 votes
Accepted

Use a Named Credential with API key?

Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named ...
sfdcfox's user avatar
  • 494k
27 votes
Accepted

Mavensmate: Getting error client identifier invalid while authentication to salesforce

To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce. MavensMate's codebase has ...
Joe Ferraro's user avatar
21 votes
Accepted

Pros and cons of user-agent flow vs web server flow

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
sfdcfox's user avatar
  • 494k
17 votes
Accepted

What is "Sfdx Auth Url" attribute used for?

The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential. In fact it is the easiest way to authenticate through CLI. ...
Mohith Shrivastava's user avatar
11 votes

error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration

I had the same problem. I found that callback url in the connected app should be the same as you have in your redirect_uri. I tested it with a tool called postman, maybe that can help you as well.
ChristianJuul's user avatar
10 votes

Two factor authentication for Community Users

Two Factor Authentication is supported for Community Users as pointed out by Rob Cowell. For standard user license type, you my be accustomed to enabling 2FA via the System Permission Two-Factor ...
Doug Ayers's user avatar
  • 4,196
9 votes
Accepted

How can I avoid Salesforce expiring my password and/or token without warning?

Your token didn't expire, your password did. As an administrator, you can make a Permission Set with the Password Never Expires permission, and assign it to your user account (affects only yourself), ...
sfdcfox's user avatar
  • 494k
9 votes
Accepted

Salesforce Server-To-Server API authentication

I believe the JWT Bearer OAuth 2.0 flow is the way to go here. There is some setup involved (you need to generate/use an X509 certificate, use the user-agent or web-server flows to authorize once), ...
Derek F's user avatar
  • 62.1k
9 votes
Accepted

How is this possible to use the Salesforce CLI after changing my user's password?

Salesforce CLI use an access token to connect to your org. This means that even if you change your password or even your username it will still be connected to your org trough your username. If you ...
gvgramazio's user avatar
9 votes

Mavensmate: Getting error client identifier invalid while authentication to salesforce

MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see. There is the chance it could ...
gelliott181's user avatar
8 votes

Facebook as Auth Provider - no username or email passed in Auth.Data

Fill the field 'User Info Endpoint URL' (on Auth provider page ) with this and test it out. https://graph.facebook.com/me?fields=first_name,last_name,email Reason for suggestion is: Facebook api v2....
Sergio Valle's user avatar
8 votes
Accepted

Is there a better way to do two-factor authentication?

There's two main ways to use 2FA. The first is where you enter a code each time you log in, and the second is where you authenticate the login through a mobile app. If you install the Salesforce ...
sfdcfox's user avatar
  • 494k
7 votes
Accepted

How do I authorize access to a managed application in another org?

I just went through something similar where the final destination varied depending on the customer so a static callback int he code did not work. What I did on our LMA org to handle this was: Placed ...
Eric's user avatar
  • 54.2k
7 votes

Determine whether running user is logged in from within Trusted IP Range (from Apex)

You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as ...
Brent Bowers's user avatar
  • 3,144
7 votes

Mavensmate: Getting error client identifier invalid while authentication to salesforce

As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost ...
NSjonas's user avatar
  • 10.2k
7 votes
Accepted

Testing Community "Passwordless Login" using the System.UserManagement Class

I think the sad truth is that there is currently (as at v47.0) no support in Apex for testing those methods or the corresponding TwoFactorMethodsInfo API. I'm asking around for verification, but the ...
Daniel Ballinger's user avatar
6 votes
Accepted

When to use username & password flow to obtain a token

The username-password flow is only intended for development. It is insecure and should never be used for a production application. As this help topic helpfully warns: This OAuth authentication flow ...
sfdcfox's user avatar
  • 494k
6 votes

Pros and cons of user-agent flow vs web server flow

Coming back to answer my own question. The answers above were true at the time but IETF no longer recommends using User Agent at all. As well, Web Server flows have been updated to not require a ...
brezotom's user avatar
  • 1,087
6 votes
Accepted

Using basic http authentication to authorize connection

You can't use Basic Authentication with Salesforce. Instead, use the SOAP login() call or the OAuth Username-Password authentication flow.
sfdcfox's user avatar
  • 494k
6 votes
Accepted

Sandbox verification emails

Have a look at the SandboxPostCopy Interface. It should be possible to have Apex run after the Sandbox is created and then modify the specific User records email address fields.
Daniel Ballinger's user avatar
6 votes

What method to use in a batch apex in order to get authentication token from a remote server?

I just had a similar requirement that I'm filling by using Platform Cache to hold the token and its expiration timestamp. It looks basically like this: public class WSAuthentication { public ...
Thomas Taylor's user avatar
6 votes
Accepted

How does a website that accesses my salesforce metadata/data authorize against my org?

Connected Apps are "global metadata". They don't need to be present in the target org, just in a single, persistent org that you control. If you maintain that Connected App in your own org, you can ...
David Reed's user avatar
  • 93.1k
5 votes
Accepted

Server to Server JWT Authentication Certificate management

The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow. Setup: Setup the App, get the required client_key and client_secret Build > Create > Apps Create a new Keypair ...
LoG's user avatar
  • 161
5 votes

Using SAML to authenticate user for a force.com site

If I understand your question correctly, this should be the approach you should be following. Force.com sites do support SSO using SAML. You need to provide the following info for your identity ...
Gaurav Kheterpal's user avatar
5 votes

Accessing Named Credentials' data in apex

One option is to use Merge Fields for Apex Callouts That Use Named Credentials. This won't explicitly give you access to the data from the named credential in Apex, but it will allow you to alter how ...
Daniel Ballinger's user avatar
5 votes
Accepted

"Unable to resolve request into a Service Provider" return by Salesforce Identity Provider for SAML 2.0 request

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's ...
ceiroa's user avatar
  • 1,029
5 votes

REST API server-to-server communication

I would rather use the OAuth 2.0 JWT Bearer Token Flow. The only prerequisite is to have on both servers the same certificate for: at your server side, sign the request using the private key of ...
yutanpo's user avatar
  • 71
5 votes
Accepted

UserName and Password in Request body of apex callout using Named Credentials

When using merge fields you need to actually set the body like string bdy = '{ "username" : "{!$Credential.Username}", "password" : "{!$Credential.Pasword}"}' req.setBody(bdy); The format will ...
Eric's user avatar
  • 54.2k
5 votes
Accepted

Getting Metadata API server URL when using OAuth flow

The Server URLs for the various APIs are easy enough to move between: Enterprise API: https://server-api.salesforce.com/services/Soap/c/27.0/orgId Partner API: https://server-api.salesforce.com/...
Daniel Ballinger's user avatar
5 votes
Accepted

Salesforce REST API Named Credential INVALID_SESSION_ID

Salesforce doesn't support direct Password Authentication to use the REST API. Typically you would go through an OAuth flow to get a valid access token to then call the service. You could go down this ...
Daniel Ballinger's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible