Salesforce API Getting Started: Account, Keys, First Request (2026)

Getting started overview

Integrating with the Salesforce API requires a structured approach, beginning with environment setup and culminating in successful authenticated requests. This guide provides a rapid path to making your initial API calls, covering account creation, credential generation, and a basic data query.

The Salesforce platform offers several API types, including REST API, SOAP API, and Bulk API, each designed for specific integration patterns. For most getting started scenarios, the REST API is recommended due to its simplicity and stateless nature, leveraging standard HTTP methods and JSON payloads. Authentication primarily relies on OAuth 2.0 for secure access management, although session-based authentication is also supported for certain use cases.

The following table outlines the key steps to get started with the Salesforce API:

Create an account and get keys

To begin, you will need a Salesforce environment. The Salesforce Developer Edition is a free, fully functional environment specifically designed for development and testing, providing access to the full suite of Salesforce APIs without cost. This is the recommended starting point.

1. Sign Up for a Developer Edition Org: Navigate to the Salesforce Developer Signup page and complete the registration form. You will receive an email to verify your account and set your password.
2. Log In to Your New Org: After setting your password, log in to your Developer Edition org.
3. Reset Your Security Token (if using password flow or older integrations): While OAuth 2.0 is preferred, some older integrations or quick tests might use username-password authentication combined with a security token. To reset it:
   • In Salesforce, click your user icon (top right) and select Settings.
   • In the left sidebar, navigate to Personal Information > Reset My Security Token.
   • Click Reset Security Token. Salesforce will email you a new token. Keep this token secure.
4. Create a Connected App (for OAuth 2.0): A Connected App is a framework that enables external applications to integrate with Salesforce using APIs. It provides a secure way to manage access and authentication.
   • From Setup, enter App Manager in the Quick Find box, then select App Manager.
   • Click New Connected App in the top right.
   • Under Basic Information, provide a Connected App Name (e.g., MyFirstAPIApp), an API Name (auto-populated), and your Contact Email.
   • Under API (Enable OAuth Settings), check Enable OAuth Settings.
   • For Callback URL, enter https://localhost/callback (or a valid URL for your application).
   • Under Selected OAuth Scopes, add Access and manage your data (api) and Perform requests on your behalf at any time (refresh_token, offline_access).
   • Click Save.
   • After creating the app, click Continue. You'll be taken to the Connected App's detail page. Note the Consumer Key and Consumer Secret under the API (Enable OAuth Settings) section. These are your application's credentials.
   • It may take a few minutes for the Connected App to be available.

Your first request

We'll use the OAuth 2.0 Username-Password Flow for this example, as it's straightforward for initial testing from a script or command line. For production applications, the Web Server Flow or JWT Bearer Flow are often more appropriate.

1. Obtain an Access Token (OAuth 2.0 Username-Password Flow)

Send a POST request to the Salesforce OAuth token endpoint. Replace placeholders with your actual values:

• YOUR_USERNAME: Your Salesforce username (email address).
• YOUR_PASSWORD: Your Salesforce password.
• YOUR_SECURITY_TOKEN: The security token you reset earlier.
• YOUR_CONSUMER_KEY: The Consumer Key from your Connected App.
• YOUR_CONSUMER_SECRET: The Consumer Secret from your Connected App.
• YOUR_LOGIN_URL: For developer orgs, this is typically https://login.salesforce.com. For sandbox orgs, it's https://test.salesforce.com.

curl -X POST \
  "https://YOUR_LOGIN_URL/services/oauth2/token" \
  -d "grant_type=password" \
  -d "client_id=YOUR_CONSUMER_KEY" \
  -d "client_secret=YOUR_CONSUMER_SECRET" \
  -d "username=YOUR_USERNAME" \
  -d "password=YOUR_PASSWORDYOUR_SECURITY_TOKEN"

A successful response will return a JSON object containing your access_token, instance_url, and other details. The instance_url is crucial as it's the base URL for all subsequent API calls to your specific Salesforce org.

{
  "access_token": "00Dxxxxxxxxxxxxxxxxxxxxxxxxx!xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "instance_url": "https://your-instance.my.salesforce.com",
  "id": "https://login.salesforce.com/id/00Dxxxxxxxxxxxxxxx/005xxxxxxxxxxxxxxx",
  "token_type": "Bearer",
  "issued_at": "1678886400000",
  "signature": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

2. Make a REST API Call (Query Accounts)

With your access_token and instance_url, you can now make authenticated requests. Let's query the first five Account records using the Salesforce REST API Query Resource.

curl -X GET \
  "https://YOUR_INSTANCE_URL/services/data/v58.0/query/?q=SELECT+Id,Name,Type+FROM+Account+LIMIT+5" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"

Replace YOUR_INSTANCE_URL with the instance_url from the token response and YOUR_ACCESS_TOKEN with your obtained access token. The v58.0 in the URL represents the API version; always use the latest available or a version compatible with your environment.

A successful response will return a JSON object containing the queried Account records:

{
  "totalSize": 5,
  "done": true,
  "records": [
    {
      "attributes": {
        "type": "Account",
        "url": "/services/data/v58.0/sobjects/Account/001xxxxxxxxxxxxxxx"
      },
      "Id": "001xxxxxxxxxxxxxxx",
      "Name": "Express Logistics and Transport",
      "Type": "Customer - Direct"
    },
    // ... more account records
  ]
}

Common next steps

After successfully making your first API call, consider these next steps to deepen your integration with Salesforce:

• Explore Other REST API Resources: Investigate other REST API resources for creating, updating, and deleting records, managing metadata, or executing Apex code.
• Implement Different OAuth Flows: For production applications, implement more robust OAuth flows like the Web Server Flow for web applications or the JWT Bearer Flow for server-to-server integrations without user interaction.
• Utilize Salesforce SDKs: Leverage official Salesforce SDKs available for languages like Java, Node.js, and Python to simplify API interactions and handle authentication complexities.
• Understand SOQL and SOSL: Master Salesforce Object Query Language (SOQL) for querying data and Salesforce Object Search Language (SOSL) for text-based searches.
• Build Custom Objects and Fields: Extend the Salesforce data model by creating custom objects and fields to store specific data relevant to your business needs, which are then accessible via the API.
• Explore Platform Events and Change Data Capture: For real-time integrations, investigate Platform Events and Change Data Capture (CDC) to subscribe to data changes and events within Salesforce.
• Consider API Limits: Be aware of Salesforce API limits to design efficient and scalable integrations that avoid hitting daily or concurrent request thresholds.

Troubleshooting the first call

Encountering issues during your first API calls is common. Here are some typical problems and their solutions:

• Invalid Username/Password/Security Token:
  • Issue: Authentication fails with invalid_grant or similar errors.
  • Solution: Double-check your username, password, and ensure the security token is appended directly to the password without any separators. Remember, the security token is only needed when authenticating directly with username/password, not typically with standard OAuth web server flows.
• Incorrect Consumer Key/Secret:
  • Issue: OAuth token request returns invalid_client.
  • Solution: Verify that the Consumer Key and Consumer Secret used in your OAuth request exactly match those from your Salesforce Connected App.
• Incorrect Callback URL in Connected App:
  • Issue: When using the Web Server Flow, the authorization redirect fails.
  • Solution: Ensure the Callback URL configured in your Connected App matches the redirect URI used in your OAuth authorization request.
• Insufficient OAuth Scopes:
  • Issue: API calls fail with insufficient_access or access_denied even after authentication.
  • Solution: Go to your Connected App settings in Salesforce Setup > App Manager. Under Manage > Edit Policies > OAuth Policies, ensure that the necessary OAuth scopes (e.g., api, refresh_token) are assigned. Also, check the Profile or Permission Set assigned to the user to ensure they have API Enabled permission and object-level access.
• Incorrect Instance URL:
  • Issue: API calls return 404 Not Found or connection errors.
  • Solution: Ensure you are using the correct instance_url obtained from the OAuth token response for all subsequent API calls. Do not hardcode login.salesforce.com for API calls themselves.
• API Version Mismatch:
  • Issue: API calls fail or behave unexpectedly.
  • Solution: Always specify a valid and supported API version (e.g., v58.0) in your API URLs. Refer to the Salesforce API versions documentation.
• Firewall or Network Restrictions:
  • Issue: Requests time out or fail to connect.
  • Solution: Ensure your network or firewall allows outbound connections to Salesforce IP ranges. For enterprise environments, consult your network administrator.
• Rate Limits Exceeded:
  • Issue: API calls return REQUEST_LIMIT_EXCEEDED errors.
  • Solution: Design your application to respect Salesforce API limits. Implement exponential backoff and retry logic, and consider using the Bulk API for large data operations.