Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am writing an extension for an email client that will integrate emails and contacts from Salesforce.

It looks like the correct way to do the oauth thing will be using the User-Agent Flow method.

Is this the best way?

How do you handle the redirect_uri in a desktop app?

Is there any open-source example of the procedure using eg. WebKit?

Does the Token Refresh action require a browser window/user intervention again or does it happen behind the scenes?

Why is the client_secret optional for Token Refresh? What would adding it achieve?

share|improve this question
up vote 2 down vote accepted

For a desktop or other native application, the redirect URI is usually handled within some kind of browser component in the native language. The redirect URI can, at that point, be something "fake" (I like to call it a "fauxtocal"). So the flow would go:

  1. Send browser to with your app credentials
  2. After user confirmation, app sends user to your URI
  3. Depending on the language, detect either the URI itself - or sometimes you need to detect an error scenario since the page will be "not found"
  4. Parse access token from URI, close browser component.

Token refresh can be done behind the scenes with just the access token. I don't have an answer on why client secret is sometimes optional - but I would say if you don't need to send it, don't send it.

share|improve this answer
Is there any example somewhere for this @joshbirk if so can you please share that link? – Sathya Jan 17 '13 at 19:53
Is there a particular language you're looking for? I have a fairly complete iOS example here: – joshbirk Jan 18 '13 at 1:18
Mobile apps can't keep secrets, so the user-agent flow doesn't use client secret, and user-agents don't specify the client secret when refreshing tokens. – metadaddy Jan 23 '13 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.