This is related to a previous question I asked: See: salesforce saml bearer oauth flow

Anyway i am still having problems understanding how to consistently get an access token from salesforce for a resource and then utilize that access token. Yesterday i managed to get an access token. For a given user i was noticing in the login history that the remote access 2.0 app was successful. Now this morning, having changed nothing, i am getting the following error:

{"error_description":"expired authorization code","error":"invalid_grant"}

This is really strange as i am not using an authorization code (as I am using SAML bearer flow). It looks like there is a setting in salesforce i am missing to consistently get a token for this flow. Also yesterday i noticed one other thing. When i did manage to get a token, the format of the token was different to the token i received from salesforce when using 3 legged oauth flow.

Can anyone shed any light on why i am now getting the expired authorization code message ?

Thanks again for all your help

2 Answers 2


Ok thanks for all the help. I have now got this working. Here is what i had to do. Firstly i wasnt allowing for clock skew. So it looks as if timezone was out so an expired authorization code seems to be state that time is wrong. Once i changed this i got a token. Token format was like this: {"scope":"id full api web visualforce chatter_api","instance_url":"https://eu2.salesforce.com","access_token":"00Db00000........etc "}

WHen i tried to access the resource i then got the following error: 401 Unauthorized INVALID_SESSION_IDSession expired or invalid. I was initially trying to access resource: https://na9.salesforce.com/services/data/v20.0/

But i noticed that the instance_url i retrieved from token was eu based https://eu2.salesforce.com and not na9 . Once i changed the resource to https://eu2.salesforce.com/services/data/v20.0/ - i successfully got a response.

Hope this information helps other people. I think it would also be nice if more information was returned from salesforce on error.

THanks again Clive


On the Connected App either set All Users can authorize or if you want to pre approve certain users, set Admin Approved Users are Pre Authorised and either add the Profiles to the Connected App or add individual users to an empty permission set and associate it with the connected app.

Also, check that you're posting the Base64URLEncoded SAML Assertion to /services/oauth2/token

and passing "grant_type=urn:ietf:params:oauth:grant-type:saml2-bearer"

If you want to try using curl, it looks like

curl -X POST https://test.salesforce.com/services/oauth2/token -d "grant_type=urn:ietf:params:oauth:grant-type:saml2-bearer" -d "assertion=<BASE64_URL_ENCODED_ASSERTION>"

The SAML Assertion has some time validity options NotOnOrBefore, NotOnOrAfter - you'll need to ensure all these are current and not in the past.

  • Token endpoint and grant type are correct.This worked yesterday for me accessing from a different machine. Firstly i don't understand why i get a expired authorization code message in the saml bearer flow. Conditions seem fine: saml:Conditions NotBefore="2013-10-11T10:20:24.39Z" NotOnOrAfter="2013-10-12T10:20:24.39Z">). I have 1 connected app. Permissions are "Admin approved users are pre-authorized" and i have 1 profile which has system administrator profile and 1 permission set with assigned connected app set to the app. Any other ideas. How can i debug this better ? Thanks again
    – user4077
    Oct 11, 2013 at 10:42
  • To add to this - my issuer is the client_id of connected app, name id is email address of system admin user, audience and recipient are login.salesforce.com/services/oauth2/token.
    – user4077
    Oct 11, 2013 at 10:59
  • Worth pointing out that Z indicates time in GMT - so those should be valid GMT Times. Oct 11, 2013 at 11:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .