Authenticated Oauth workflow required constant login

Question

I am very new to the Salesforce API. I am creating a library which connects to Salesforce and accesses data etc.

I am implementing the Web Server Oauth Authentication workflow (https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_web_server_oauth_flow.htm), with the understanding that it differs from the Username-Password workflow in that you shouldn't have to log in each time.

My understanding was that since the client secret is stored on the server, once a connection between the server and Salesforce instances occurs, login credentials are no longer necessary.

I am finding that this is not the case. Every time the Salesforce session expires, my API call first redirects to Salesforce, asks for username/password, and then it can move forward.

Am I using the incorrect workflow? Are there some settings I'm missing in my REST App configuration?

Here is a my authorization URL:

https://test.salesforce.com/services/oauth2/authorize?response_type=code&client_id=[my-client-id]&redirect_uri=https://my-redirect.com

Answer 1

I am implementing the Web Server Oauth Authentication workflow with the understanding that it differs from the Username-Password workflow in that you shouldn't have to log in each time.

That's not correct. With an OAuth flow, you get a token, which you can utilize to login to any system. A token signifies that you are authorized to perform operations based on behalf of an authenticated user.

Tokens will always expire. It just depends upon the maximum expiration limit, which you can set up to 24 hours. So as soon as your token expires, you will need to authenticate yourself again to be able to get a new token.

With the Web Server OAuth Authentication Flow, what you do is that you get a refresh token, which is as good as your username/password, so you should be carefully storing that somewhere. And that in this flow, you can generate a new token whenever it expires by just using the refresh token, instead of sending the username and password with the request.

Apps that are hosted on a secure server use the web server authentication flow. A critical aspect of the web server flow is that the server must be able to protect the consumer secret.

Take a look at How Does the OAuth Refresh Token Fit Into the Authentication Flow?, which explains how you can use refresh token to get a new token whenever it expires.

Both the web server OAuth authentication flow and user-agent flow provide a refresh token that can be used to get a new access token. Access tokens have a limited lifetime specified by the session timeout in Salesforce. If an application uses an expired access token, a “Session expired or invalid” error is returned. If the application is using the web server or user-agent OAuth authentication flow, a refresh token is provided during authorization. Use this refresh token to get a new access token.