I don't know how to explain this, but its totally weird and strange, Please take some time to read it.

Let's understand the flow here, Let's start with the flow first what we are actually doing there. we are having a third party app which is hosted on Azure and that third party have an exposed endpoint which calls our Salesforce API(my custom written API). Now this third party app call my SF custom API when I call one endpoint, the logic which reside on that particular endpoint internally calls my API.Now when I'm calling this third party endpoint API, I pass Salesforce authentication information like session id, instance URL and my service API URI, which can be used by the third party app to call my API.

So to summarize the workflow, I'm calling a third party endpoint with SF authentication info, and then that third party app calls my Salesforce custom API with that authentication info.

let's move further we are calling third party app from the Process builder invocable method, and invocable method calls a future method to do the third party API call. now as we know we couldn't get session id in future method so I'm generating session id in invocable method and passed it to future method as a parameter. now that session id along with other authentication info pass to the third party app by calling an endpoint, below the sample authentication request which we are sending to third party app.

   "authInfo" : {
                "instanceUrl" : "https://na30.salesforce.com",
                "serviceUri" : "/services/apexrest/MyCustomAPI",
                "sessionToken" : "<session_token>"

So as per the flow, whenever process flow executed on update/create then our invocable method called and it will call that third party app, and then that app call back to our SF API with the authentication info which we sent with the API call request.

Now comes to the problem, this flow works great when we are in classic, but when we switch to the lightning, our API is not able to called from third party app. I started digging into that and print the entire request which we are sending to third party when doing callout. I manually called the API with the same auth request (token and url) in POSTMAN, and it failed and gives me INVALID_SESSION_ID error. Now it is not the case there like token is expired, the whole flow execute within 5 ~ 8 seconds.

I did some further digging and found that whenever we use a session Id which is generated in the invocable method and in lightning UI. then that session Id cannot be used with the API callout. to reproduce the error please print system.debug session token in invocable method and then use that session token to calls the SF API, remember you should be in Lightning UI.

I just wanted to confirm that Is it the bug in the Salesforce platform? or am doing something wrong over there.


After Winter'18 release it is still not resolved. That mean this issue is not related to what Salesforce fix in winter'18, That's why opening the issue again.


  • I'm pretty sure this still falls under the security intent of Lightning Session IDs. It seems kind of silly that PB doesn't give a real Session ID you can use for the API though, since there's no way to get at that session from a Lightning Component.
    – sfdcfox
    Commented Jun 2, 2017 at 14:34
  • Thanks @sfdcfox, but really am not able to understand why it is not working with only Invocable method, even though I tried with apex classes and lightning component also, the session id which we generate that can be used without any issue, but only and only when we use any session id which is generated in invocable method while lightning mode is there. it throwing this exception? I'm not sure Is there any logged issues in salesforce or I should go and log that. Commented Jun 4, 2017 at 9:12
  • I'm encountering this problem now. Have you found any fix?
    – SamuelDev
    Commented Feb 15, 2018 at 11:47
  • @SamuelDev, Updated the answer, please refer below. Commented Feb 15, 2018 at 17:07

1 Answer 1


I raised the concern to Salesforce and it's categorized as a known bug, they are going to resolve it in Winter'18 release.

See below bug reference for more details:

Summer'17- Generating a Session Id from Lightning Domain Provides Invalid Session Id

Update [After Winter 18]

The issue is still there, had a case opened with Salesforce Support and it is verified that this is the documented limitation in lightning system, Refer below link: https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/apex_api_calls.htm

Got following workaround from SF support (Which I was already using)
Getting Session ID in Lightning

  • Interesting. I am using a session id from apex in a lightning component comtd and it works fine. Maybe for comtd it's not an issue
    – Eric
    Commented Jun 8, 2017 at 7:02
  • @Eric Want to know more about your implementation, how did you do that? well my original question is when the session id is generated in Invocable method and you are in lightning then it won't work. But my issue merged with this known issue. Commented Jun 8, 2017 at 7:22
  • Simply called an auraenabled method to get userinfo.getsessionId() and the used it in a typical comtd lightning implementation. Not sure it falls into your issue though. Something specific you wanted to know?
    – Eric
    Commented Jun 8, 2017 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .