Salesforce Docs Portal

Connect to REST-based APIs

To connect to any REST-based API, such as REST API, Bulk API 2.0, or Connect API, follow these steps. For testing, use the Salesforce collection for Postman, which handles authorization for you.

Prerequisites

Before you complete these steps, create an external client app.

After you create the external client app, activate OAuth2 settings.

Finally, after you activate the OAuth2 settings, copy the Consumer Key and Consumer Secret. The Consumer Key maps to the client_id value that you use to obtain the authentication token, and the Consumer Secret maps to the client_secret.

Step 1: Obtain an Authentication Token

Issue a POST request to the /services/oauth2/token endpoint. The body of the request must contain the consumer ID and secret for your external client app. It must also contain the username and password of your API user.

POST /services/oauth2/token HTTP/1.1
Host: MY_DOMAIN_LOGIN_URL
Content-Type: application/json

{
    "grant_type": "password",
    "client_id" : CONSUMER_KEY,
    "client_secret": CONSUMER_SECRET,
    "username": USERNAME,
    "password": PASSWORD
}

If the API accepts your request, it returns a 200 response with information about the token.

{
    "access_token": "YOUR_ACCESS_TOKEN",
    "instance_url": "https://MY_DOMAIN_LOGIN_URL",
    "id": "https://login.salesforce.com/id/wRYO4cyiogGJuSu/HQ7tfVfduzymohBchM",
    "token_type": "Bearer",
    "issued_at": "1722887135000",
    "signature": "RESPONSE_SIGNATURE"
}

Copy the value of the access_token property.

Step 2: Use the Authentication Token in API Requests

When you make subsequent calls to REST API or Bulk API 2.0, provide your bearer token as an Authorization header.

Authorization: Bearer YOUR_AUTH_TOKEN

An easy way to test your authentication token is to issue a GET call to the /services/data/API_VERSION/limits endpoint.

GET /services/data/API_VERSION/limits HTTP/1.1
Host: generativecampaign248.test1.lightning.pc-rnd.force.com
Authorization: Bearer YOUR_ACCESS_TOKEN

If your request is successful, the response includes information about the API usage limits that apply to your account.

{
    "ActiveScratchOrgs": {
        "Max": 3,
        "Remaining": 3
    },
    "AnalyticsExternalDataSizeMB": {
        "Max": 40960,
        "Remaining": 40960
    },
    "ConcurrentAsyncGetReportInstances": {
        "Max": 200,
        "Remaining": 200
    },
    ...
}

Authentication tokens expire based on the session policy for your org. When your token expires, issue another POST request to the authentication endpoint to obtain a new token.

See Also