Connect to Salesforce from desktop application with oauth

Question

I am writing an extension for an email client that will integrate emails and contacts from Salesforce.

It looks like the correct way to do the oauth thing will be using the User-Agent Flow method.

Is this the best way?

How do you handle the redirect_uri in a desktop app?

Is there any open-source example of the procedure using eg. WebKit?

Does the Token Refresh action require a browser window/user intervention again or does it happen behind the scenes?

Why is the client_secret optional for Token Refresh? What would adding it achieve?

Answer 1

For a desktop or other native application, the redirect URI is usually handled within some kind of browser component in the native language. The redirect URI can, at that point, be something "fake" (I like to call it a "fauxtocal"). So the flow would go:

1. Send browser to login.salesforce.com with your app credentials
2. After user confirmation, app sends user to your URI
3. Depending on the language, detect either the URI itself - or sometimes you need to detect an error scenario since the page will be "not found"
4. Parse access token from URI, close browser component.

Token refresh can be done behind the scenes with just the access token. I don't have an answer on why client secret is sometimes optional - but I would say if you don't need to send it, don't send it.