2

I'm pushing back on the claims I've read that security tokens "only change when user changes the password, or regenerates the token."

My API access stopped working unexpectedly, and I couldn't get any API requests to go through. (This was a big problem for the business I work for.)

When I tried to log in normally the website kicked me over to a password change page, as if Salesforce had expired my password and was demanding that I make a new one.

The API only started working again when I changed my password and generated a new token. Changing these was the ONLY change I made, and it has worked fine since then.

In other words, I experienced the token expiring or changing, WITHOUT the user changing the password or regenerating the security token. There was no warning of any kind.

How can I set up my API access to function more reliably, so that I'm not blindsided by the sudden enforced failure of my requests by Salesforce?

Improve this question

1 Answer 1

Reset to default
9

Your token didn't expire, your password did. As an administrator, you can make a Permission Set with the Password Never Expires permission, and assign it to your user account (affects only yourself), or you can change the Password Policies so that passwords never expire (affects all users in your org). You'll never have to worry about expired passwords again. Just remember to change it periodically, as a matter of being recommended security practice. Depending on your API/integration, if you set up an OAuth2 session with a Refresh Token, the application that authenticates this way will be able to use the Access Token/Refresh Token indefinitely until the session is explicitly logged out or revoked, even if the user's user name, password, or token changes.

Improve this answer
6
  • Thanks! More info, agreeing with @sfdcfox, here: success.salesforce.com/answers?id=90630000000gvkFAAQ
    – Ben Wheeler
    Commented Jul 7, 2017 at 19:42
  • 1
    You can also assign that permission at the Profile level, no?
    – Adrian Larson ♦
    Commented Jul 7, 2017 at 19:42
  • 1
    @AdrianLarson For custom profiles, yes, but if the user is still a standard System Administrator, they won't be able to do so.
    – sfdcfox ♦
    Commented Jul 7, 2017 at 19:44
  • Ah, good point.
    – Adrian Larson ♦
    Commented Jul 7, 2017 at 19:46
  • 1
    @BenWheeler Salesforce comes with many different standard profiles. You can think of them as "default" profiles, because they come with most of their permissions locked down (i.e. you can't add/remove most permissions). The standard System Administrator is the most powerful of the default profiles, and is automatically assigned to the first user created in an org. It has permissions to customize Salesforce, create users, and modify almost any record. It can't have its permissions modified, so you need a Permission Set. Those are found in Setup > Manage Users > Permission Sets.
    – sfdcfox ♦
    Commented Jul 15, 2017 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .