I'm using Named Credentials with OAuth authentication. When calling a method on the endpoint, my Apex app receives back the status that the token needs to be refreshed.

How do I tell Salesforce to start the OAuth process for my Named Credential?


Everything is setup and works fine:

  • The external SAAS service uses OAuth Authorization Code Grant with its own OAuth endpoints.
  • Created Authentication Metadata in SFDC for the service
  • Wrote and installed an Auth Provider Plugin Apex class
  • Authorized the Remote Site for just the authorization service (not for the API url itself.)
  • Added the new Auth Provider
  • Added the new Named Credential


  • Each user then adds an entry for the Auth Provider via their Personal Settings / Authentication Settings for External Systems screen.
  • Completing this step causes the OAuth process to happen: the browser is redirected to the SAAS service's authentication service. After authenticating and authorizing the app, the person is returned to SFDC.
  • At this point, the person can use the Apex application which makes use of the Named Credential.
  • Life is good.

However, 8 hours later, the token needs to be refreshed.

The best would be for my Apex program to be able to rerun the OAuth flow. The user would then re-login, as needed.

So back to the original question: How do I tell Salesforce to start the OAuth process for my Named Credential or for the user's Authentication Settings for External Systems record?

Currently, if my Apex program detects that the user needs to re-authenticate, I give them the following instructions. What I want is to give the user a button that they push. That would cause the OAuth flow to start.

  • From My Settings, enter auth in the Quick Find box, then select Authentication Settings for External Systems
  • For the -saas service- entry, click Edit then click Save. Depending on your -saas service- security settings, you may be redirected to the -saas service- to sign in.
    More information.
  • Can you add some more details to your questions for ex. code spinet, the end point, any configuration that you have done on end point. I will help us to diagnose the issue. Id possible add details to such a level where we can reproduce the issue. Sep 5, 2016 at 9:07
  • Named Credentials generally works fine and probability there must be configuration issue causing this problem. Sep 5, 2016 at 9:09
  • @AtulRajguru9 Everything is working fine until the user needs to re-authenticate with the remote system. How can my Apex program initiate the flow so the user doesn't have to click through their settings themselves?
    – Larry K
    Sep 5, 2016 at 12:16

1 Answer 1


Once you are authenticated you don't need to re-authenticate with external service again.

Every external system provide refresh token with access token and using that refresh token you need to refresh the access token.

You can use batch which will run in backend and refresh your access token. Schedule this batch to run in 7 hours.

To refresh the access token using refresh token you can follow these links.

  1. OAuth 2.0 Refresh Token Flow

Although this is link for SF token but the basic idea will remain same here.

Sample code.

POST /services/oauth2/token HTTP/1.1
Host: https://login.salesforce.com/ 
grant_type=refresh_token&client_id=Your client id here&client_secret=Your client secert here
&refresh_token=your token here 

For the second point where you need to re-authentication you can do one thing. Create a checkbox and if checkbox is true then update record type with a button for re-authentication and once user click on this button and re-authenticate you can again change the pagelayout and hide the button.

In your batch if you get time 0 then update the record with checkbox true.so user can see the button for re-authenticate.

And as you are system admin so you need to store their access token and refresh token in some place and your code can access it from there.

  • 1
    Sorry @TusharSharma, you are not correct. Some higher security SAAS services do require periodic re-authentication by the user. (Token refreshes can give a 0 validity time if that is their security policy.) Also, you're not providing any information on how to refresh the tokens of the individual users. I don't see how I have any access to the app's client id or secret, either. Only the Named Credential system has access to that info.
    – Larry K
    Sep 5, 2016 at 12:35
  • @LarryK updated my answer. Please check. Sep 5, 2016 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .