I would like to ask question from the curiosity perspective and want to share what I have observed for access_token in salesforce ?

I had called https://ap5.salesforce.com/services/oauth2/token, 2 hours before and it was giving me access_token shown below.

enter image description here

After two hours again when I call that endpoint to get the access_token again its giving me the same access_token and using that access_token I can call target systems REST endpoints.

I wonder why salesforce producing the same access_token every-time?

Also I don't see the any validity of access_token coming in the above json response.

I expect normally in OAuth2, whenever you call for the OAuth2 token, you will issue with the new access_token every-time whenever you ask for it. But in salesforce its producing the same access_token, why ?

Also whats the difference between grant_type password and authorization. how they make difference in calling ?

  • Please stop tagging your posts with [salesforce-communities] unless they are actually related to the Communities feature.
    – Adrian Larson
    Apr 27, 2017 at 20:18
  • ok will do. Just let me know what tag I need to used for salesforce related issues? Apr 27, 2017 at 20:21
  • If you're posting here on the Salesforce Stack Exchange, it's either related to salesforce or it's off topic. There is no need to let us know it's related to Salesforce. That's why we are here.
    – Adrian Larson
    Apr 27, 2017 at 20:25

1 Answer 1


If you already have a valid session for a given Client ID and User ID, then the system returns the same access token. Only after an access token expires or is revoked will you get a new access token. Each context (e.g. Visualforce, Browser, and each application you use) will receive its own unique access token that identifies the user and the application using that token.

The difference between password and authorization is that password generates a regular session ID and does not grant a refresh token, even if you ask for it, while authorization can issue refresh tokens and uses the OAuth2 flow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .