Why don't I get a new refresh token when I refresh an access token in Salesforce?

Question

When I first authenticate to Salesforce, I get an access token and a refresh token. But if the access token has expired I make a call using the refresh token to get a new access token, but in the response there is no new refresh token.

Is that correct? Does the refresh token never expire for Salesforce?

Here is the call I am making to get a new access token using the refresh call.

var client = new RestClient("https://myOrg.salesforce.com/services/oauth2/token");
var request = new RestRequest("", Method.POST);
request.AddParameter("refresh_token", {currentRefreshToken}, ParameterType.GetOrPost);
request.AddParameter("grant_type", "refresh_token", ParameterType.GetOrPost);
request.AddParameter("client_id", {clientId}, ParameterType.GetOrPost);
request.AddParameter("client_secret", {clientsecret}, ParameterType.GetOrPost);
var response = client.Execute(request);

I would have expected a new Refresh token in the response.

Answer 1

Access Tokens are governed through the global Session Settings or the Profile Session Settings, while Refresh Tokens are controlled via OAuth Access Policies. You simply reuse a Refresh Token as long as it is valid, which can be one of: "until revoked", "immediately", "inactive for x time", or "until x time has passed". If you lose the Refresh Token, it is expired, or revoked, the user will need to log in again. At this point, you would receive a new Refresh Token as part of the login flow. Note that Refresh Tokens will survive password resets, Security Token resets, and changing the username entirely. This makes them very durable for the purposes of maintaining a session in an app.