---
schema_version: "1"
id: c4430bae511277f777a8b8f1c659f5e980465ddd3655a3b7fbf4e75bbc887bc0
title: OAuth 1.0.A Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_1_flows.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 10316eb57475bcf31e71498f99ae44b8a4cf85fcad715d611710dec4a38936d2
description: If your org uses the OAuth 1.0.A protocol, use this authorization flow to integrate a client—via a connected app—with the Salesforce API.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 1.0.A Flow

If your org uses the OAuth 1.0.A protocol, use this authorization flow to integrate a client—via a connected app—with the Salesforce API.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d78561e61">User Permissions
            Needed</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e61 ">To manage, create, edit, and delete OAuth apps:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e61 ">Manage Connected Apps</td>

        </tr>
      </tbody>
    </table>

Here are the major authorization steps.

- The connected app [requests a request token](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5). Salesforce verifies the request and returns a request token.
- The [user logs in and authorizes the connected app](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5) to access data.
- The connected app [requests an access token](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5).
- After Salesforce verifies the request and grants the token, the connected app [accesses the data](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5).

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_tip.png)

Tip To use a connected app with a sandbox, use test.salesforce.com instead of login.salesforce.com in the following sections.

For the list of possible error codes returned by Salesforce, see [OAuth 1.0.A Error Codes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_errorcodes.htm&release=264.0.0&type=5 "Errors can occur during authorization. For example, the callback URL is invalid. When errors occur during the OAuth 1.0.A flow, Salesforce returns an error code.").

## Request a Request Token

To initiate the OAuth 1.0.A flow, the connected app sends a request to the Salesforce OAuth request token handler endpoint (https://login.salesforce.com/\_nc\_external/system/security/oauth/RequestTokenHandler).

Include the following OAuth parameters in the request.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d78561e158">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d78561e161">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e158 ">
              <code>oauth_consumer_key</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e161 ">The consumer key of the connected app. To access the consumer
              key, from the App Manager, find the connected app and select
              <strong class="uicontrol">View</strong> from the dropdown. Then click
              <strong class="uicontrol">Manage Consumer Details</strong>. You're sometimes
              prompted to verify your identity.
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e158 ">
              <code>oauth_signature_method</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e161 ">The OAuth signature method must be HMAC-SHA1 for this
              flow.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e158 ">
              <span id="remoteaccess_oauth_1_flows__oauth_signature"><a name="remoteaccess_oauth_1_flows__oauth_signature"><!-- --></a>
                <code>oauth_signature</code>
              </span>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e161 ">
              <p>The OAuth signature used for login, which you generate according
                to the OAuth specification for HMAC-SHA1.</p>
              <p>You can use one of these
                methods to generate the <code>oauth_signature</code>.</p>
              <ul>
                <li>User interface—Use
                  <samp class="filepath">https://login.salesforce.com</samp> for
                  generating the signature.
                </li>
                <li>API—Use
                  <samp class="filepath">https://login.salesforce.com/services/OAuth/<var>type</var>/<var>api-version</var></samp>
                  for generating the signature.<p><var>type</var> must
                    have one of the following values.</p>
                  <ul>
                    <li><code>u</code>—Partner
                      WSDL</li>
                    <li><code>c</code>—Enterprise
                      WSDL</li>
                  </ul>
                  For example,
                  <samp class="filepath">https://login.salesforce.com/services/OAuth/u/17.0</samp>.
                </li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e158 ">
              <code>oauth_timestamp</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e161 ">Time stamp of when the signature was created.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e158 ">
              <code>oauth_nonce</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e161 ">Optional. Allows the service provider to verify that a request
              hasn’t been made before, and helps prevent replay attacks.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e158 ">
              <code>oauth_version</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e161 ">Optional. If included, the OAuth version must be 1.0 for this
              flow.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e158 ">
              <code>oauth_callback</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d78561e161 ">
              <p>Must be one of the following values:</p>
              <ul>
                <li>URL hosted by the consumer, for example,
                  <samp class="filepath">https://www.appirio.com/sfdc_accounts/access_token_ready.html</samp>.
                  This URL uses HTTPS or another protocol. It can’t use
                  HTTP.
                </li>
                <li><code>oob</code>, meaning out of
                  band.</li>
              </ul>
            </td>

          </tr>
        </tbody>
      </table>

After Salesforce receives the request, it does the following:

- Validates the request with its own copy of the consumer secret.
- Generates a response containing a request token and request token secret in the HTTP body as name and value pairs.
- Sends the response back to the consumer.

A request token is valid for 15 minutes, plus 3 minutes to allow for differences between machine clocks.

## User Authorizes Access

After the connected app makes its initial request for the request token, the user is prompted to authorize access.

- The connected app redirects the user to https://login.salesforce.com/setup/secur/RemoteAccessAuthorizationPage.apexp. The appropriate GET query parameters are appended to this URL.
    
    - `oauth_token` (request token)
    - `oauth_consumer_key`
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note If an `oauth_callback` parameter is included, it's ignored.
- The user is prompted to authorize access for the connected app on the Remote Access Authorization page.
- After the user authorizes access, Salesforce generates the access token and access token secret.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note A user can grant a limited number of concurrent access tokens to an app. The default is five per app per user. If this authorization exceeds the org’s limit, the user is notified and the last used tokens are revoked.
- Salesforce verifies the callback URL and redirects the user as follows.
    - If the `oauth_callback` defined in the request token is `oob` and the connected app’s callback URL is valid, the user is redirected to that URL.
    - If the `oauth_callback` defined in the request token is a valid URL, the user is redirected to that URL.

## Request the Access Token

After the user authorizes access for the connected app, the connected app can exchange a request token for an access token. It makes an HTTPS GET or POST request to https://login.salesforce.com/\_nc\_external/system/security/oauth/AccessTokenHandler. Include these parameters in the query or post data.

 
| Parameter | Description |
| --- | --- |
| `oauth_consumer_key` | The consumer key of the connected app. To access the consumer key, from the App Manager, find the connected app and select **View** from the dropdown. Then click **Manage Consumer Details** and verify your identity. |
| `oauth_signature_method` | The OAuth signature method must be HMAC-SHA1 for this flow. |
| oauth\_signature | The OAuth signature used for login, which you generate according to the OAuth specification for HMAC-SHA1. See [`oauth_signature`](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5). |
| `oauth_timestamp` | Time stamp of when the signature was created. |
| `oauth_token` | The request token that the connected app received in its initial request. |
| `oauth_nonce` | Optional. Allows the service provider to verify that a request hasn’t been made before, and helps prevent replay attacks. |
| `oauth_verifier` | The request token secret that the connected app received in its initial request. |
| `oauth_version` | Optional. If included, the OAuth version must be 1.0 for this flow. |

Salesforce validates these elements in the request:

- Consumer secret
- Consumer key
- Signature
- Whether the request token has been used before
- Timestamp (must be within 15 minutes, plus 3 minutes to allow for differences between machine clocks)
- Whether the nonce has been used before

Upon validation, Salesforce returns the access token and access token secret in the HTTP response body as name and value pairs.

## Access Data

After the connected app possesses a valid access token, it can access Salesforce data by posting a request to https://login.salesforce.com. The following parameters are included in the HTTP POST authorization header.

 
| Parameter | Description |
| --- | --- |
| `oauth_consumer_key` | The connected app’s consumer key. To access the consumer key, from the App Manager, find the connected app and select **View** from the dropdown. Then click **Manage Consumer Details**. You're sometimes prompted to verify your identity. |
| `oauth_token` | The access token that the connected app received from Salesforce. |
| `oauth_signature_method` | The OAuth signature method must be HMAC-SHA1 for this flow. |
| oauth\_signature | The OAuth signature used for login, which you generate according to the OAuth specification for HMAC-SHA1. See [`oauth_signature`](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5). |
| `oauth_timestamp` | Time stamp of when the signature was created. |
| `oauth_nonce` | Optional. Allows the service provider to verify that a request hasn’t been made before, and helps prevent replay attacks. |
| `oauth_version` | Optional. If included, the OAuth version must be 1.0 for this flow. |

Salesforce validates the request and sends a valid session ID to the connected app. The session ID is short-lived and valid only for frontdoor.jsp. To obtain a session ID that can be used directly, use the API access token exchange.

Access Salesforce Data Using the API

When the connected app possesses a valid access token, it can request to access Salesforce data using the Lightning Platform API. The connected app can post a request to https://login.salesforce.com/services/OAuth/type/api-version.

Replace the URL variables with the following:

- type must have one of the following values.
    - `u`—Partner WSDL
    - `c`—Enterprise WSDL
- api-version must be a valid API version.

Include the following parameters in the HTTPS POST authorization header.

 
| Parameter | Description |
| --- | --- |
| `oauth_consumer_key` | The consumer key of the connected app. To access the consumer key, from the App Manager, find the connected app and select **View** from the dropdown. Then click **Manage Consumer Details**. You're sometimes prompted to verify your identity. |
| `oauth_token` | The access token that the connected app received from Salesforce. |
| `oauth_signature_method` | The OAuth signature method must be HMAC-SHA1 for this flow. |
| oauth\_signature | The OAuth signature used for login, which you generate according to the OAuth specification for HMAC-SHA1. See [`oauth_signature`](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_1_flows.htm&release=264.0.0&type=5). |
| `oauth_timestamp` | Time stamp of when the signature was created. |
| `oauth_nonce` | Optional. Allows the service provider to verify that a request hasn’t been made before, and helps prevent replay attacks. |
| `oauth_version` | Optional. If included, the OAuth version must be 1.0 for this flow. |

Salesforce validates the request and sends a valid session ID to the consumer. The response header includes the following content.

```markup
<response>
    <metadataServerUrl>https://yourInstance.salesforce.com/services/Soap/m/17.0/00D300000006qjK
    </metadataServerUrl>
    <sandbox>false</sandbox>
    <serverUrl>https://yourInstance.salesforce.com/services/Soap/u/17.0/00D300000006qjK
    </serverUrl>
    <sessionId>00D300000006qrN!AQoAQJTMzwTa67tGgQck1ng_xgMSuWVBpFwZ1xUq2kLjMYg6Zq
       GTS8Ezu_C3w0pdT1DMyHiJgB6fbhhEPxKjGqlYnlROIUs1</sessionId>
</response>
```

#### See Also

- [Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_about.htm&type=5&language=en_US)
- [OAuth 1.0.A Authorization Error Codes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_errorcodes.htm&release=264.0.0&type=5 "Errors can occur during authorization. For example, the callback URL is invalid. When errors occur during the OAuth 1.0.A flow, Salesforce returns an error code.")