When using the client_credentials OAuth grant type in Postman to call a custom Apex REST endpoint, a "401 Unauthorized — This session is not valid for use with the REST API" error may occur even when an access token is successfully obtained. This error occurs because the Connected App configured for the client_credentials grant type is missing the "Managed user data via APIs (API)" OAuth scope. Without this scope, access tokens generated via the client_credentials flow are not authorized to call REST API endpoints, including custom Apex REST classes at /services/apexrest/.
Screenshot showing a 401 Unauthorized error response in Postman when calling a custom Apex REST endpoint. The response body displays: This session is not valid for use with the REST API.
To resolve the "401 Unauthorized — This session is not valid for use with the REST API" error when using the client_credentials grant type, add the required OAuth scope to the Connected App:
1. Add the 'Managed user data via APIs (API)' OAuth scope to the connected app's selected OAuth Scopes.
2. Test the API call again using the 'client_credentials' grant type in Postman after adding the OAuth scope.
3. Save the Connected App and wait a few minutes for the change to propagate across Salesforce infrastructure, then re-test your API call in Postman.
005226515

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.