Force.com REST API getting token with curl

Force REST API usage with curl is really well documented, there are at least two official HowTO's, but both of the assume that you will get your OATH token with Java. Below I've described steps required to get the token and verify your token with curl.

1. Retrieve token

curl -v -k https://DOMAIN.salesforce.com/services/oauth2/token 
-d "grant_type=password" -d "client_id=CONSUMER_KEY" 
-d "client_secret=CONSUMER_SECRET" -d "username=USERNAME" 
-d "password=USER_PASSWORDSECURITY_TOKEN"

where:

• DOMAIN - is your salesforce domain (e.g. na9)
• CONSUMER_KEY, CONSUMER_SECRET - as taken from App Setup -> Develop -> Remote Access
• USERNAME, USER_PASSWORD, SECURITY_TOKEN - properties for the user that you want to connect with. Note that USER_PASSWORD and SECURITY_TOKEN are concatenated.

Note that I used -k parameter in curl which results in the SSL certificate validation skipped (otherwise you need to add it or the root certificate to your key store). 

In the response you'll get for example (for na9.salesforce.com):

* About to connect() to na9.salesforce.com port 443 (#0)

*   Trying 96.43.145.44... connected

* SSLv3, TLS handshake, Client hello (1):

* SSLv3, TLS handshake, Server hello (2):

* SSLv3, TLS handshake, CERT (11):

* SSLv3, TLS handshake, Server finished (14):

* SSLv3, TLS handshake, Client key exchange (16):

* SSLv3, TLS change cipher, Client hello (1):

* SSLv3, TLS handshake, Finished (20):

* SSLv3, TLS change cipher, Client hello (1):

* SSLv3, TLS handshake, Finished (20):

* SSL connection using RC4-MD5

* Server certificate:

*        subject: C=US; ST=California; L=San Francisco; O=Salesforce.com, Inc.;

OU=Applications; CN=na9.salesforce.com

*        start date: 2010-12-16 00:00:00 GMT

*        expire date: 2012-12-15 23:59:59 GMT

*        common name: na9.salesforce.com (matched)

*        issuer: C=US; O=VeriSign, Inc.; OU=VeriSign Trust Network; OU=Terms of

use at https://www.verisign.com/rpa (c)10; CN=VeriSign Class 3 International Ser

ver CA - G3

*        SSL certificate verify result: unable to get local issuer certificate (

20), continuing anyway.

> POST /services/oauth2/token HTTP/1.1

> User-Agent: curl/7.23.1 (x86_64-pc-win32) libcurl/7.23.1 OpenSSL/0.9.8r zlib/1

.2.5

> Host: na9.salesforce.com

> Accept: */*

> Content-Length: 212

> Content-Type: application/x-www-form-urlencoded

>

* upload completely sent off: 212 out of 212 bytes

< HTTP/1.1 200 OK

< Server:

< Content-Type: application/json; charset=UTF-8

< Transfer-Encoding: chunked

< Date: Tue, 12 Jun 2012 05:03:02 GMT

<

{"id":"https://login.salesforce.com/id/00DE0000000YDIrMAO/005E00000017YfmIAE","i

ssued_at":"1339477382420","instance_url":"https://na9.salesforce.com","signature

":"jpqWF7t6KtWszMCuzCcXOkzqUxTw+7bSv0X5G3+jHBA=","access_token":"00DE0000000YDIr

!AQYAQEfgbWngXrxWpagPgEMckQCD1C6K5K9KoUVRUr0oLt.BN4rufk1pyGskMxdbxuAY5OkdAY.J36e

_Iscm_lc699oIILoE"}* Connection #0 to host na9.salesforce.com left intact

* Closing connection #0

* SSLv3, TLS alert, Client hello (1):

The token that you're looking for in this case is:  00DE0000000YDIr!AQYAQEfgbWngXrxWpagPgEMckQCD1C6K5K9KoUVRUr0oLt.BN4rufk1pyGskMxdbxuAY5OkdAY.J36e_Iscm_lc699oIILoE

2. Test if everything works

The simplest way to test if the token works is list objects that you have available for given token. You can do it with:

curl -k https://na9.salesforce.com/services/data/v20.0/sobjects/ 
-H "Authorization:OAuth TOKEN" -H "X-PrettyPrint:1"

If you get a long list of JSON formatted objects - you're good to continue as per information in the official force.com REST API developer guide:
http://www.salesforce.com/us/developer/docs/api_rest/index.htm

Additional reading describing OATH usage:
https://na9.salesforce.com/help/doc/en/remoteaccess_oauth_username_password_flow.htm