---
schema_version: "1"
id: 5049eb48f650b5f0ace5bf720a6eba457ee6301e9d7839cc84816db3c8cf9422
title: "Headless Login: Send a Token Request"
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/security/headless-identity-impl-guide/guides/headless-identity/headless-identity-login-token-exchange.md
canonical_url: https://developer.salesforce.com/docs/platform/headless-identity-impl-guide/guide/headless-identity-login-token-exchange.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 8930fc6d380577866e7c14bdfc9ff67e1cc3866ce7bf2c16aabd5f4792b5a182
products:
  - Headless Identity Implementation Guide
  - Security
---

# Headless Login: Send a Token Request

After you send the authorization request and get a code, exchange the code for an access token.

|Required Editions|
|-----------------|
|Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience|
|Available in: **Enterprise**, **Unlimited**, and **Developer** Editions|

1.  From the Headless Identity API Demo folder in Postman, select **Username Password Login - Token Exchange**.

    Note the location of the POST request. It’s the `/services/oauth2/token` endpoint on your Experience Cloud site.

2.  To see the request body, click **Body**. The token request for headless login includes these parameters.


    -   `code`—The authorization code from Salesforce.
    -   `grant_type`—The OAuth 2.0 grant type. Because the OAuth 2.0 authorization code grant type is the foundation of this flow, this parameter is set to `authorization_code`.
    -   `client_id`—The external client app consumer key.
    -   `redirect_uri`—The external client app callback URL, which points to the OAuth 2.0 echo endpoint.
3.  For the `code`, enter the authorization code that you received in your response from the previous step.

4.  To send the request to the token endpoint, click **Send**.

    Salesforce validates the token request and returns a response to your app. The response contains an access token that can be used to access Salesforce APIs and other identifying parameters. Here’s an example access token response in Postman.

    ```nolang
    {
        "access_token": "00DR**********",
        "sfdc_community_url": "https://MyExperienceCloudSite.my.site.com",
        "sfdc_community_id": "0DBXXXXXXXXXXXXXXXX",
        "signature": "CPk2JprUcxOmRHND71gJFn+SxyKe7jWqA1rQnFz9zZg=",
        "token_format": "opaque",
        "scope": "openid api",
        "id_token": "eyJr**************",
        "instance_url": "https://yourInstance.salesforce.com",
        "id": "https://yourInstance.salesforce.com/id/00Dxxxxxxxxxxxx/005xxxxxxxxxxxx",
        "token_type": "Bearer",
        "issued_at": "1667600739962"
    }
    ```