I found we need refresh token for renewing access token for REST API. But i couldn't find refresh token in response of my request. How can I get refresh token.Here is my code in PHP.

    $postData = array(
        'grant_type' => 'password',
        'client_id' => 'my_client_id',
        'client_secret' => 'my_client_secret',
        'username' => 'my_admin_username',
        'password' => 'my_admin_password+security token'

    $token_url = 'https://cs57.salesforce.com/services/oauth2/token';

    $curl = curl_init();
    curl_setopt_array($curl, array(
        CURLOPT_HEADER => false,
        CURLOPT_URL => $token_url,
        CURLAUTH_ANY => true,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $postData

    $json_response = curl_exec($curl);

    $status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $response = json_decode($json_response,true);

And the response I get is

Array ( [access_token] => my token 
        [instance_url] => https://cs57.salesforce.com 
        [id] => https://test.salesforce.com/id/00D0k0000000Xu2EAE/0057F000000q8KFQAY 
        [token_type] => Bearer 
        [issued_at] => 1503288742327 
        [signature] => wt/b1QFLd8EJmIx6Max8rW2xmovdj3q/onMdKfExAqo= 

As per the salesforce docs I should get refresh token also. But why I am not getting it. Or do I miss something here?


It seems like, I asked a very dump question. I was following ' username-password authentication flow ' and the doc clearly says

" This OAuth authentication flow passes the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token is issued. "

  • You need to set an offline scope – Eric Aug 21 '17 at 4:57
  • For the connected app, already i have given : 1)Full access (full) 2) Perform requests on your behalf at any time (refresh_token, offline_access). Also set Callback URL: ap5.salesforce.com/services/oauth2/token. I am initiating the API request from my local system(Desktop system), is that a problem? – sajeesh Aug 21 '17 at 5:28

This has always been the best guide to oAuth for me: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com

Re refresh tokens, see this section: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com#Token_Refresh

But yes, it depends on the type of flow you are using, and how the Connected App is configured. But a Web Server Flow or User Agent flow should return one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.