I have my access token session set to expire every 24 hours, but if someone uses that token (say through a rest API call) at some point, does it last for another 24 hours or does the session not restart?

  • @Eric sooooo when i set the session timeout value under session settings, that doesn't affect the access token at all? – Nicholas Siegmundt Sep 14 '16 at 20:05
  • developer.salesforce.com/page/… – Eric Sep 14 '16 at 20:16
  • I read that post eric, but in the answer, it's stated that "Sessions expire based on your organization's policy for sessions. Basically, as long as the app is in active use, the session won't expire." Is he not referring to the access token here? Because the originally question in that thread was asking about the access token.. – Nicholas Siegmundt Sep 14 '16 at 20:35

"Access Tokens", as well as "SOAP Session Identifiers" ("sid" for short, in most cases) are all treated the same. They are sessions that have an expiration date. You can see your sessions in Setup > Security Controls > Session Management.

Any use of a session, such as running a query, updating a record, or even getting the server time stamp will result in the session being updated. This behavior is the same for all types of sessions, no matter where they originated from.

In other words, a 24-hour expiry means that the user must do something with the token at least once every 24 hours. Any time the user does something, the timer is reset.

You can verify this behavior by checking out the Session Management screen.

  • Thanks! That's exactly what I wanted to know. Now one other thing i was wondering is, what if I reuqest a new access token (using the user-agent flow), does that count as "doing something with the token" or is the time not reset? – Nicholas Siegmundt Sep 14 '16 at 20:50
  • Does this answer mean you don't see the question as a dupe? – Adrian Larson Sep 14 '16 at 20:51
  • @AdrianLarson I can see how one could consider it a dupe, because this answer is partially contained in the answer in the other question, but the other question was about "how to know when the session expires" versus "does the session expire while you're using it"... Which makes the two strongly related, but not identical, in my opinion. – sfdcfox Sep 14 '16 at 20:54
  • Fair enough. I thought it was reasonable to decide either way, then saw you answered here as well and became less sure. It doesn't much matter if we have a few near duplicates on here anyway, and in this case it seems distinct enough. – Adrian Larson Sep 14 '16 at 20:58
  • @NicholasSiegmundt Using a login flow creates a new token, so any existing tokens won't be updated. Keep in mind that there's also a 5-per-client-id limit, so if there's more than five, the oldest ones will be killed. – sfdcfox Sep 14 '16 at 21:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.