---
updatedAt: 2025-10-02T13:22:15.000Z
agentTools:
  projectIndex: https://developer.alloy.com/public/llms.txt
---

# Password

Availability: All Customers

This grant type is used for webhooks integrated with a 3rd party service, i.e. salesforce.

Alloy will `POST` a request to the authorization server using the `client_id` , `client_secret` and the `username` , `password` (i.e. salesforce credentials).

Note an authorization header derived from `client_id` and `client_secret` will be sent with every request, see [Basic Authentication](/docs/basic-authentication)

```jsx Request
POST /oauth2/token
Authorization: Basic QTdLNFg5VDJNQjpMME41QzhWMVFa
Content-Type: application/json
{
  "grant_type": "password",
  "username": "david_user",
  "password": "davidpass",
  "client_id": "A7K4X9T2MB",
  "client_secret": "L0N5C8V1QZ"
}
```

Authorization server responds with an `access_token`:

```jsx Response
{
  "access_token": "abc123",
  "token_type": "Bearer",
  "expires_in": 3600
}
```

Alloy will `POST` a request to webhook endpoint using the `access_token`:

```jsx Request
POST /webhook-endpoint
Authorization: Bearer abc123
Content-Type: application/json
```

**Example webhook configuration:**

<Image align="center" src="https://files.readme.io/c2535e2f133def594ee3d1c2f1c24900aef693f5ea1445ca6460a4ef7fb56c60-Screenshot_2025-06-09_at_9.24.36_AM.png" />