Configure authentication in Salesforce

To start working with Financials via the Force.com REST API, you need to configure an authentication flow in your Salesforce organization. The authentication flow we’re going to set up in this section is called the Username-Password OAuth Authentication Flow. It isn’t the most secure one, but it’s fastest to implement for demo purposes.

NOTE: In a production environment, you may want to use a more secure authentication flow. For information about all authentication flows you can use with the Force.com REST API, see Understanding Authentication in the Force.com REST API Developer Guide.

Step 1: Create a connected app in Salesforce

  1. Log on to your Salesforce org as a system administrator.
  2. Go to Setup > App Manager, click New Connected App, and then configure the following:
    • Connected App Name. Type a descriptive name for your app.
    • API Name. Type a descriptive name for the API.
    • Contact Email. Enter your contact email.
  3. Under API (Enable OAuth Settings), select the Enable OAuth Settings check box, and then configure the following:
    • Callback URL. Enter any URL starting with https://.
    • Selected OAuth Scopes. Move Full access (full) to the Selected OAuth Scopes column. We set up this scope for demo purposes only. In a production environment, you may want to set up a more strict authentication scope.
  4. Click Save.

Step 2: Take note of your app’s key and secret

  1. Click Continue.
  2. On the page that opens, under API (Enable OAuth Settings), copy the Consumer Key and Consumer Secret values and store them for further use.

Step 3: Get an access token from Salesforce

To try out the steps in this section, install Postman and open the Postman collection we have prepared for you:

Download Postman Open Postman Collection

In the collection, open one of the following requests and replace variables with actual values:

WARNING: Before making any changes to your production organization in Salesforce, test them in a sandbox or scratch org first. For more information, see Develop with Sandbox and Quick Start: Using a Sandbox and Change Sets in the Salesforce Development Lifecycle Guide.

  1. Configure your application to send one of the following POST requests:

    • To get an access token for a sandbox or scratch org: 
       POST https://test.salesforce.com/services/oauth2/token
    • To get an access token for a production org: 
       POST https://login.salesforce.com/services/oauth2/token

  2. Configure the request headers to include the following key-value pair:

    Key Value
    Content-Type application/x-www-form-urlencoded

  3. Configure the request body to include the following key-value pairs:

    Key Value
    grant_type password
    client_id {consumer key you copied in step 2 in Configure authentication in Salesforce}
    client_secret {consumer secret you copied in step 2 in Configure authentication in Salesforce}
    username {your Salesforce user name}
    password {your Salesforce password}
  4. Send your request.

  5. In the response body, locate and copy the values of the access_token and instance_url parameters. The parameter values looks similar to the following:

     "access_token": "00D0N000000h6Yq!AR0AQH8Q246.FAmlewZKdJYJ_O3y1ziq62BbR5Gj0yk9yznYqT.YDjz.rZzTZ0d8aLB9WR2EGz6.myY_Z.smrDiERcF7iKP0",
 "instance_url": "https://my-domain-1234.cs89.my.salesforce.com"

    Append the access_token value to all subsequent HTTP requests your application sends to Financials via the Salesforce REST API. If your token expires, get a new access token by repeating Step 3: Get an access token from Salesforce above.

    Use the instance_url value to compose the URLs for sending HTTP requests to Financials deployed in your Salesforce domain.

    For example:

     GET https://my-domain-1234.cs89.my.salesforce.com/services/data/v43.0/queryAll?q=SELECT Id, Name FROM s2cor__Sage_COR_Company__c