New answers tagged


It is up-to Salesforce org administrator to configure this behavior for the Connected App. Every org that goes through the Authorization via OAuth, the Salesforce System Admin will see the Connected App under Set Up > Connected Apps > Manage Connected App The Admin can click to edit the policies and enable the PIN protection and select PIN length as ...


Log a case with Salesforce. They will be able to tell which app the credentials were generated from.


This code should not be used to authenticate a user with the web server, only to enable API access to the specified community. In that context, your proposed attack won't allow any access, as the access token is only "valid" for the attack server. It's always important to make sure that you understand the context for the type of code you're writing....


After many hours of trial and error, I realized the issue was caused by how I logged into the organisation. Using sfdx force:org:open does not provide the correct context for REST API usage. Instead you need to generate a password for the user account using sfdx force:user:password:generate and login through the lightning login portal.

Top 50 recent answers are included