# Connect to REST-based APIs

To connect to any REST-based API, such as REST API, Bulk API 2.0, or Connect API, follow these steps. For testing, use the Salesforce collection for Postman, which handles authorization for you.

## Prerequisites

Before you complete these steps, [create an external client app](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm).

After you create the external client app, [activate OAuth2 settings](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_oauth_settings.htm).

Finally, after you activate the OAuth2 settings, copy the Consumer Key and Consumer Secret. The Consumer Key maps to the `client_id` value that you use to obtain the authentication token, and the Consumer Secret maps to the `client_secret`.

## Step 1: Obtain an Authentication Token

Issue a POST request to the `/services/oauth2/token` endpoint. The body of the request must contain the consumer ID and secret for your external client app. It must also contain the username and password of your API user.

```
POST /services/oauth2/token HTTP/1.1
Host: MY_DOMAIN_LOGIN_URL
Content-Type: application/json

{
    "grant_type": "password",
    "client_id" : CONSUMER_KEY,
    "client_secret": CONSUMER_SECRET,
    "username": USERNAME,
    "password": PASSWORD
}
```

If the API accepts your request, it returns a 200 response with information about the token.

```
{
    "access_token": "YOUR_ACCESS_TOKEN",
    "instance_url": "https://MY_DOMAIN_LOGIN_URL",
    "id": "https://login.salesforce.com/id/wRYO4cyiogGJuSu/HQ7tfVfduzymohBchM",
    "token_type": "Bearer",
    "issued_at": "1722887135000",
    "signature": "RESPONSE_SIGNATURE"
}
```

Copy the value of the `access_token` property.

## Step 2: Use the Authentication Token in API Requests

When you make subsequent calls to REST API or Bulk API 2.0, provide your bearer token as an Authorization header.

```
Authorization: Bearer YOUR_AUTH_TOKEN
```

An easy way to test your authentication token is to issue a GET call to the `/services/data/API_VERSION/limits` endpoint.

```
GET /services/data/API_VERSION/limits HTTP/1.1
Host: generativecampaign248.test1.lightning.pc-rnd.force.com
Authorization: Bearer YOUR_ACCESS_TOKEN
```

If your request is successful, the response includes information about the API usage limits that apply to your account.

```
{
    "ActiveScratchOrgs": {
        "Max": 3,
        "Remaining": 3
    },
    "AnalyticsExternalDataSizeMB": {
        "Max": 40960,
        "Remaining": 40960
    },
    "ConcurrentAsyncGetReportInstances": {
        "Max": 200,
        "Remaining": 200
    },
    ...
}
```

Authentication tokens expire based on the session policy for your org. When your token expires, issue another POST request to the authentication endpoint to obtain a new token.

## See Also

- Trailhead: [Quick Start: Connect Postman to Salesforce](https://trailhead.salesforce.com/content/learn/projects/quick-start-connect-postman-to-salesforce)