• Salesforce uses the OAuth protocol to allow users of applications to securely access data without having to reveal username and password credentials.
• Before authenticate the application you need Connected App. Reference: https://help.salesforce.com/articleView?id=connected_app_create.htm&type=5
• OAuth Endpoints: Use to make authentication requests to Server.

Authorization:
https://login.salesforce.com/services/oauth2/authorize

Token Requests:
https://login.salesforce.com/services/oauth2/token

Revoking OAuth Tokens:
https://login.salesforce.com/services/oauth2/revoke

How Username & Password Flow Works

• Request an Access Token

Access tokens, which are Salesforce Session IDs that cannot be intercepted, are produced via the username-password flow. Even though they have an active session, connected applications employing this flow aren’t shown on the Connected applications OAuth Usage page since the access tokens are only valid for a short time. Refresh tokens and scopes are not supported in this flow. The OAuth 2.0 username-password route is not supported by Experience Cloud websites.

By sending the user’s username and password to the Salesforce token endpoint as an out-of-band POST, the connected app can request an access token. An example of this is this POST.

Payload
https://login.salesforce.com/services/oauth2/token?grant_type=password&client_id=YOUR_CONSUMER_KEY&client_secret=YOUR_CLIENT_SECRET_KEY&username=YOUR_USERNAME&password=YOUR_PASSWORD+SECURITY_TOKEN

Sample Payload
https://login.salesforce.com/services/oauth2/token?grant_type=password&client_id=3MVxxxxxxxxx&client_secret=C5Dxxxxxxxxxxxxxxxxxxx&username=adminxxxxxxx@xxxx.com&password=xxxxxxxxx

Salesforce Grants an Access Token

Salesforce replies to the customer with a response following request verification.
This is an illustration of a response.

{
    "access_token": "00Dxxxxxxxxxxxxx!AREAQJdkLCHtP0lBou9yLUnmliaV_vnYz6lwUFMyPWll.N1.KvLSnIQRWBwGyppuAC2b3YuCs_PsRQR66txtf.ufLU5nc2cT",
    "instance_url": "https://xxxxxx-dev-ed.my.salesforce.com",
    "id": "https://login.salesforce.com/id/00Dxxxxxxxxxxxxx/005xxxxxxxxxxxx",
    "token_type": "Bearer",
    "issued_at": "1707169913024",
    "signature": "E/cKhiE93RpdO/7SczsjLReMx+dbMcXbQPdwFx3NTeI="
}

• Reference https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_username_password_flow.htm&type=5