I am a novice in salesforce. I have access to multiple sandbox instances of salesforce. I am trying to do an OAuth2.0 authentication and call some rest api. But when I request for the token, in the response I am not getting the desired instance url. Any idea how to get the desired instance url?
Because that instance url will be the url for further rest api call that I want to perform.
I am using https://test.salesforce.com/services/oauth2/token to get the token.
The different endpoints are used for different authentication flows, this is all covered in the REST API documentation.
The /authorize endpoint is used for the Web Server OAuth Authentication Flow and User-Agent OAuth Authentication Flow.
The /token endpoint is used for the Username-Password OAuth Authentication Flow and the OAuth Refresh Token Process.
Web Server OAuth Authentication Flow
The Web server authentication flow is used by applications that are hosted on a secure server. A critical aspect of the Web server flow is that the server must be able to protect the consumer secret.
In this flow, the client application requests the authorization server to redirect the user to another web server or resource that authorizes the user and sends the application an authorization code. The application uses the authorization code to request an access token. The following shows the steps for this flow.
User-Agent OAuth Authentication Flow
The user-agent authentication flow is used by client applications (consumers) residing in the user’s device. This could be implemented in a browser using a scripting language such as JavaScript, or from a mobile device or a desktop application. These consumers cannot keep the client secret confidential.
In this flow, the client application requests the authorization server to redirect the user to another Web server or resource which is capable of extracting the access token and passing it back to the application. The following shows the steps for this flow.
Username-Password OAuth Authentication Flow
The username-password authentication flow can be used to authenticate when the consumer already has the user’s credentials.
In this flow, the user’s credentials are used by the application to request an access token as shown in the following steps.
Warning
This OAuth authentication flow involves passing the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token will be issued.
OAuth Refresh Token Process
The Web server OAuth authentication flow and user-agent flow both provide a refresh token that can be used to obtain a new access token.
Access tokens have a limited lifetime specified by the session timeout in Salesforce. If an application uses an expired access token, a “Session expired or invalid” error is returned. If the application is using the Web server or user-agent OAuth authentication flows, a refresh token may be provided during authorization that can be used to get a new access token.
You need valid client_id and client_secret in order to request a valid token to perform API requests. You can obtain these alphanumeric strings by creating a custom app in your org (this may help: https://developer.salesforce.com/forums/?id=906F0000000AfcgIAC )
When you've got your client_id and client_secret, follow the instructions I wrote on a different question, it should work for you then: Sending data from PHP to Salesforce using CURL
Best Answer
You can call out to your own org's OAuth endpoints in the same way that you call out to the endpoints at test.salesforce.com and login.salesforce.com to get an access token. These are all valid endpoints and behave the same way:
Whichever endpoint you call out to will return the FQDN of the org as the
instance_urlvalue in the return payload. Since client IDs and secrets are unique across all orgs, you can call out your custom domain and login/test (depending on if your instance is a Production or Sandbox instance)The only major consideration is for Government Cloud customers, who cannot reach their orgs through the generic login URLs and must use their custom domains.