Our application interacts with our clients' Salesforce instances using the REST API and refresh tokens we have stored on our database. Every API request will use that refresh token to get an access token to perform transactions.

There are a small subset of clients that are receiving errors when attempting to use the application. According to our logs, when attempting to use those clients' refresh tokens, Salesforce returns a (400) Bad Request error. Generating a new refresh token for the client seems to resolve the issue.

The flow of the app is as follows:

  1. User enters app
  2. App checks if a refresh token for the client is stored in the database
  3. If one is not available, get a new refresh token and store it in the database
  4. Outside of Salesforce, the stored refresh token is used to generate an access token every time an update is needing to be made in Salesforce using the Rest API
  5. That access token is used only for the one call, never used again.

Based on this flow, the user should always be using the app's most recently granted token, so I don't see how that token would get invalidated.

I'm curious as to what would cause certain refresh tokens to become invalid? They aren't supposed to expire, so what might be the cause?

  • Possible duplicate of salesforce.stackexchange.com/questions/65590/… Mar 23, 2016 at 15:46
  • Thanks @MarcZaharescu. I did review that thread but I don't see any situation within our app wherein the client would request 5 subsequent request tokens, then attempt to use an older token. I've added some details on the flow of the application to the original post.
    – emroc
    Mar 23, 2016 at 19:56

1 Answer 1


Resolve this issue. Turns out it was Salesforce's recent TLS 1.0 disablement changes that were causing tokens to not get generated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.