2

The case is after authorization, I get the access_token and refresh_token and then distribute the same copy of tokens to different runtime instances. And I'd like to let each runtime instance to have separated token refresh cycle.

After the access_token is expired, there will be token refresh request happened in different instances. So the questions are:

  1. Since the refresh_token is same, will be the new generated access_token still same among different instances?

  2. If not same, that means there might be a lot active access tokens. As per Salesforce, one connected app can only have maximum 5 active access tokens https://success.salesforce.com/answers?id=90630000000Cy3EAAS&feedtype=RECENT&dc=All&criteria=OPENQUESTIONS& Then some of running instances will have issue to subsequent REST API call?

  • 2
    Possible duplicate of security token vs session id vs access token – Eric Mar 8 '17 at 17:38
  • @Eric, not same question. – zgcharley Mar 8 '17 at 18:46
  • 1
    Have you tried it? My intuition is that you will get the same access_token back. I base this on how the login() call works with the Partner API where you keep getting back the same Session ID if called in rapid succession. YMMV – Daniel Ballinger Mar 8 '17 at 23:11
  • If you've centralized the initial login, why not centralize the refresh? – martin Mar 9 '17 at 4:55
2

Based on empirical observation, using the same refresh_token to repeatedly request an access_token yields exactly the same result.

I tested establishing a session from only the known refresh_token several times over the course of 5 minutes. In all cases I got the same session ID back. This is consistent with how the login() method works in the Partner API. You keep getting the same session back until the original is invalidated, either via an explicit logout or a timeout.

Try monitoring it from the User Session Information tab. You will see the Updated and Valid until values changing, but the Created data won't change.

enter image description here

Note, my testing was all done from one IP address. Your result may vary using the refresh_token from differ IPs simultaneously.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.