How to Get a Salesforce API Key (Connected App)

Key Takeaways

• Salesforce does not issue static API keys; authenticating requires OAuth 2.0 credentials.
• Setting up a Salesforce connected app generates a consumer key (client ID) and consumer secret.
• Exchanging client credentials produces a short-lived access token for the Authorization: Bearer <token> header.
• New connected apps take up to 10 minutes to propagate across servers before token requests succeed.

Salesforce does not issue a single static Salesforce API key. Instead, developers create a Salesforce connected app in Setup to generate a consumer key (client ID) and consumer secret. You exchange these credentials at your org token endpoint for a short-lived access token passed in the Authorization: Bearer <token> HTTP header. This guide explains how software engineers configure Salesforce API authentication for background integrations and multi-tenant applications.

Prerequisites for Salesforce API Authentication

Before configuring API credentials, confirm that your user account and Salesforce org meet three requirements:

• Administrative Permissions: Your account needs "Customize Application" and "Manage Connected Apps" administrative privileges, usually assigned to System Administrators.
• My Domain Enabled: Salesforce requires My Domain deployment before OAuth 2.0 authentication functions (Salesforce Help).
• Dedicated Integration User: Salesforce Help specifies that standard API configurations should use the Salesforce Integration User license (API Only) to restrict access to automated calls instead of assigning human admin user accounts.

Select your authentication path based on your architecture. Use the Client Credentials flow for server-to-server background processes with no user interface. Use the Web Server (Authorization Code) flow for applications that act on behalf of individual logging-in users.

To plan broader system architectures across Salesforce services, consult our in-depth Salesforce API integration guide.

Step-by-Step: Creating a Salesforce Connected App

Follow these steps in Salesforce Setup to configure your OAuth settings and generate client credentials:

1. Log into your Salesforce org. In Setup, enter "App Manager" in the Quick Find box and click New Connected App.
2. Enter the basic information, including Connected App Name, API Name (populated automatically), and a contact Email.
3. Under API (Enable OAuth Settings), check Enable OAuth Settings. Enter a Callback URL such as https://localhost/callback for server-to-server flows where browser redirects do not occur.
4. Choose your OAuth Scopes. Select "Manage user data via APIs (api)" for standard REST access. Select "Perform requests at any time (refresh_token, offline_access)" if your application requires background token renewals without manual re-authentication (Salesforce Help).
5. For headless background integrations, enable Client Credentials Flow in OAuth policies and assign a dedicated execution user. The permissions assigned to this user control record access across your org (Salesforce Help).
6. Click Save. Salesforce takes up to 10 minutes to propagate new app settings across global infrastructure. Token requests fail during this propagation window.
7. Go to Manage Consumer Details inside your connected app settings. Enter the verification code sent to your email to view your Consumer Key and Consumer Secret.

Exchanging Credentials for an Access Token and Routing API Calls

Client identifiers pass to the token endpoint to request active access credentials rather than attaching directly to data endpoint headers:

POST https://login.salesforce.com/services/oauth2/token

For Client Credentials requests, send an application/x-www-form-urlencoded request body containing grant_type=client_credentials, client_id (your Consumer Key), and client_secret (your Consumer Secret). The endpoint returns a JSON payload containing access_token and instance_url.

Pass your token on API requests using the HTTP authorization header:

Authorization: Bearer <access_token>

Send REST calls to <instance_url>/services/data/v66.0/... (Salesforce Developers). Salesforce REST architecture exposes records, collections, and query results via resource endpoints (Salesforce Developers).

Domain Routing and Token Lifecycle

The instance_url string returned by token responses (such as https://yourcompany.my.salesforce.com) is instance-specific and updates during sandbox refreshes or org migrations. Hardcoding domain names instead of parsing dynamic response values causes connection failures.

Key token behaviors include:

• Lifetime: Tokens expire according to org session policies, set to 2 hours by default. Client Credentials tokens do not return refresh tokens; issue a new authentication request when tokens expire or return INVALID_SESSION_ID.
• Refresh Operations: Authorization Code flows using refresh_token scopes send grant_type=refresh_token and the refresh_token string to /services/oauth2/token to fetch new credentials silently.
• Scope Limits: The api scope opens REST, SOAP, Bulk, and Metadata endpoints. Scope settings cannot grant object permissions beyond what the profile or permission set of the designated user allows.
• Revocation: Administrators can terminate active connected app access in Setup under Apps → Connected Apps OAuth Usage.

Authorization Code Flow for User Access

Direct user browser sessions to the authorization URL when an application acts on behalf of individual users:

https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=YOUR_CONSUMER_KEY&redirect_uri=YOUR_REDIRECT_URI

After user confirmation, Salesforce returns an authorization code to your redirect_uri. Exchange this code at /services/oauth2/token with grant_type=authorization_code to receive an access token and a refresh token (Salesforce Developers).

Minimal Working Code Examples

This example authenticates via Client Credentials and queries the API limits endpoint to verify connectivity.

cURL

# 1. Exchange Consumer Key and Secret for an access token
curl -X POST https://login.salesforce.com/services/oauth2/token \
  -d "grant_type=client_credentials" \
  -d "client_id=$SF_CONSUMER_KEY" \
  -d "client_secret=$SF_CONSUMER_SECRET"

# The response returns "access_token" and "instance_url"

# 2. Call the REST API limits endpoint
curl "$SF_INSTANCE_URL/services/data/v66.0/limits" \
  -H "Authorization: Bearer $SF_ACCESS_TOKEN"

Node.js

const tokenRes = await fetch("https://login.salesforce.com/services/oauth2/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "client_credentials",
    client_id: process.env.SF_CONSUMER_KEY,
    client_secret: process.env.SF_CONSUMER_SECRET,
  }),
});

const { access_token, instance_url } = await tokenRes.json();

const res = await fetch(`${instance_url}/services/data/v66.0/limits`, {
  headers: { Authorization: `Bearer ${access_token}` },
});

console.log(await res.json());

To fetch ticket records after authenticating, see how to retrieve open tickets from the Salesforce API.

Troubleshooting Common Salesforce API Errors

Error Code / Status	Cause	Fix
invalid_client_id or invalid_client	Incorrect Consumer Key/Secret, or incomplete Connected App propagation.	Verify credentials in Manage Consumer Details. Wait up to 10 minutes after creation for global propagation (Salesforce Help).
401 INVALID_SESSION_ID	Access token expired or revoked.	Tokens expire based on org session policy (2 hours by default). Re-authenticate or exchange a refresh token (Salesforce Developers).
403 REQUEST_LIMIT_EXCEEDED	Exceeded daily API Request Limit.	Enterprise Edition orgs receive 100,000 calls per 24 hours plus 1,000 per user license. Check limits via Sforce-Limit-Info response headers (Salesforce Developers Blog).

For additional edge cases, consult our Salesforce integration troubleshooting guide.

Streamlining CRM Integrations with Knit

Configuring connected apps, managing token expirations, parsing dynamic instance domains, and tracking API call quotas requires substantial engineering effort per CRM. Maintaining separate authentication flows across multiple platforms multiplies operational overhead.

Knit’s Unified CRM API automates OAuth token lifecycle management, routes requests across dynamic instance domains, standardizes CRM record schemas, and handles API rate limits automatically. Review Knit’s Salesforce API integration or book a demo to evaluate the integration workflow. You can sign up free to test Sandbox connections.

Frequently Asked Questions

How do I find my API key in Salesforce?

In Setup, go to App Manager in Salesforce. Locate your connected app, click the dropdown menu, and select Manage Consumer Details. Enter the identity verification code sent to your email to view your Consumer Key and Consumer Secret.

What is a consumer key in Salesforce?

A consumer key in Salesforce is a public client identifier assigned to a connected app. It functions like a Client ID in standard OAuth 2.0 protocols to identify your application during API authentication requests.

Does Salesforce have API keys?

Salesforce does not use static API keys. All API operations require dynamic OAuth 2.0 access tokens generated through a connected app. This security architecture prevents long-lived static credentials from being exposed in source code.

How do I authenticate an API in Salesforce?

To authenticate an API call in Salesforce, request an OAuth 2.0 access token using your Consumer Key and Consumer Secret. Pass the returned access token in the HTTP header as Authorization: Bearer <access_token> on REST calls.

What is the difference between Client Credentials and Authorization Code flows?

The Client Credentials flow is a headless server-to-server authentication pattern bound to a single designated execution user. The Authorization Code flow requires browser interaction where an end user logs in and grants permissions explicitly.

How long does a Salesforce access token remain valid?

Salesforce access tokens follow org session security policies, which default to 2 hours. Applications using the Authorization Code flow can exchange a refresh token to obtain new access tokens without requiring user re-authentication.

Related Resources

• Compare authentication protocols with our guide to generate a HubSpot access token.
• Learn how to retrieve Zendesk API tokens for customer support tools.
• Read how to obtain an Okta API token for identity management.
• Check our guide to generate a Jira API token for Atlassian tools.