Why salesforce generating the same access_token everytime when ask for /services/oauth2/token?

Question

I would like to ask question from the curiosity perspective and want to share what I have observed for access_token in salesforce ?

I had called https://ap5.salesforce.com/services/oauth2/token, 2 hours before and it was giving me access_token shown below.

After two hours again when I call that endpoint to get the access_token again its giving me the same access_token and using that access_token I can call target systems REST endpoints.

I wonder why salesforce producing the same access_token every-time?

Also I don't see the any validity of access_token coming in the above json response.

I expect normally in OAuth2, whenever you call for the OAuth2 token, you will issue with the new access_token every-time whenever you ask for it. But in salesforce its producing the same access_token, why ?

Also whats the difference between grant_type password and authorization. how they make difference in calling ?

Answer 1

If you already have a valid session for a given Client ID and User ID, then the system returns the same access token. Only after an access token expires or is revoked will you get a new access token. Each context (e.g. Visualforce, Browser, and each application you use) will receive its own unique access token that identifies the user and the application using that token.

The difference between password and authorization is that password generates a regular session ID and does not grant a refresh token, even if you ask for it, while authorization can issue refresh tokens and uses the OAuth2 flow.