---
schema_version: "1"
id: 0a150384b127a2c3444b582b47d603312bceb764bd347289d6bbe94fffd6bc92
title: Authentication
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/event-bus/pub-sub-api/guides/supported-auth.md
canonical_url: https://developer.salesforce.com/docs/platform/pub-sub-api/guide/supported-auth.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: b2f5e19e160eba11a69f286f3c4c296ea8e9d9601e00e45b3eb81f46d9b7c3b9
products:
  - Pub/Sub API
  - Event Bus Docs
---
# Authentication

Pub/Sub API supports any authentication mechanism that enables retrieving the session ID, including OAuth, and username and password authentication.

The OAuth access token value or session ID is part of the authentication metadata header that the client passes to the Pub/Sub API RPC methods. For more information about gRPC metadata, see [Metadata](https://www.grpc.io/docs/what-is-grpc/core-concepts/#metadata) in [Core concepts, architecture and lifecycle](https://www.grpc.io/docs/what-is-grpc/core-concepts) in the gRPC documentation. For more information about authorizing your app with OAuth, see [OAuth Authorization Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flows.htm&type=5) in _Salesforce Help_.

In each RPC method, use these key-value pairs in the metadata headers. For more information about using headers in Pub/Sub API, see [Include Authorization Headers in RPC Method Calls](https://developer.salesforce.com/docs/platform/pub-sub-api/guide/rpc-method-headers.md).

| Metadata Header Name | Metadata Header Value                                                                                       |
| -------------------- | ----------------------------------------------------------------------------------------------------------- |
| `accesstoken`        | The access token if using OAuth, or the Salesforce session ID if using username and password authentication |
| `instanceurl`        | URL of the Salesforce instance. For example, `https://MyDomainName.my.salesforce.com`                       |
| `tenantid`           | The Salesforce org ID                                                                                       |

If you use OAuth, the access token expiration is controlled by the Salesforce session timeout value in the connected app, or if not set, in the user’s profile or the session settings. The session times out after 2 hours of inactivity by default, unless a custom timeout value is set. For more information, see [Manage Session Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&type=5) in _Salesforce Help_. However, the session timeout doesn’t matter for a subscriber client because the Subscribe RPC method keeps the connection alive through keepalive messages if there are still pending events to be delivered. For more details, see [Subscribe Keepalive Behavior](https://developer.salesforce.com/docs/platform/pub-sub-api/references/methods/subscribe-rpc.html#subscribe-keepalive-behavior). For the PublishStream RPC method, the connection closes if no new publish request is sent within a short time. See [PublishStream RPC Method.](https://developer.salesforce.com/docs/platform/pub-sub-api/references/methods/publishstream-rpc.html) The rest of the RPC methods execute promptly and don’t need a long-lived connection.