How to authenticate to Salesforce APIs without client Id and secret

There are multiple ways to authenticate to Salesforce SOAP and REST APIs. Usually the recommended way is to authenticate to REST API is by using OAuth and creating a connected app in Salesforce. Please check the article Using curl to authenticate to Salesforce REST API to see an example.

There is an easy way to bypass OAuth and directly use username+password combination to authenticate against Salesforce SOAP and REST APIs. It is by making SOAP login call. It will return an session Id that you can use against Salesforce SOAP and REST APIs as access token.

Getting access token with username, password and security token

You need make a HTTP call using below format. This is basically sending a login SOAP request. Make sure to use your username, password and security token in line 12 and 13. Also if you are accessing a Salesforce sandbox base part of the URL changes to https://test.salesforce.com

You can see that the API response contains sessionId tag. You can use this sessionId to call Salesforce SOAP or REST apis. Checkout below example of accessing Salesforce Rest API with the session Id. Make sure to use your session ID in authorization header and your base endpoint instead of https://salesforcecodestest-dev-ed.my.salesforce.com.

This method allows you to access Salesforce REST and SOAP apis without a client ID and secret. This is intended for server to server communication. If you use it in a client side app, you will see CORS errors.

Using curl to authenticate to Salesforce REST API

If you are building an application that needs to connect to Salesforce, there are multiple ways you can do this. Same is true for authenticating against Salesforce also. You have a wide variety of methods available to authenticate against Salesforce. You can find details of different methods using OAuth in below link.

Authenticating apps with OAuth 

Salesforce REST API, provides an efficient way to access Salesforce data. It is common to use this API from mobile apps. In this article we will have a look about how to authenticate and access data using REST API. You can use this same process to authenticate mobile/desktop applications. To demonstrate this, we are using a tool cURL. This tool is preinstalled in Mac. If you are using a windows PC, go to cURL download page and install this application. Once you have installed this tool, you can make http requests with custom headers and JSON body from terminal or command line.

There are different ways to authenticate your application against connected app in Salesforce like “Web Server OAuth flow”, User Agent OAuth flow”, “Username-password flow” etc. We are going to use OAuth 2.0 Username-Password flow here.

Authentication and data operations

1) Create a connected app in Salesforce

    First you need to create a connected app in Salesforce. You can do this by going to “Create => Apps => Connected Apps => New” under setup. Fill in the details and save. UI will looks like below image,

2) Note down Consumer Key and Consumer Secret 

    Once you have saved your details, you will be able to get “Consumer Key” and “Consumer Secret” under “API(Enable OAuth Settings)” section. Note down the values. You need to use these values while authenticating against Salesforce.

3) Authenticate to get session token 

    First step of authentication is to get session token using username, password, customer key and customer secret. This is obtained by making http request to “https://login.salesforce.com/services/oauth2/token” or “https://test.salesforce.com/services/oauth2/token” for production and sandboxes respectively using cURL. If the authentication is success, it will return a session token/access token. You can make subsequent API calls using this token. This step will look like below,

4) Do REST operations – Query/Insert/Update/Delete etc 

    Once you have access token you can make different REST API calls. All API calls should go to the instance URL returned by login call. Also access token obtained in login call should be added as “Authorization” header parameter. You can find examples of query, insert, update and delete operations below,

Summary

    Now you should have a good idea of how to authenticate your mobile/desktop application against Salesforce using username-password OAuth flow and do operations using REST API. If you are not comfortable using cURL from command line for trying this process, same steps can be done through browser extensions/chrome apps like “Advanced REST Client” or “Postman”.