I found we need refresh token for renewing access token for REST API. But i couldn't find refresh token in response of my request. How can I get refresh token.Here is my code in PHP.

    $postData = array(
        'grant_type' => 'password',
        'client_id' => 'my_client_id',
        'client_secret' => 'my_client_secret',
        'username' => 'my_admin_username',
        'password' => 'my_admin_password+security token'

    $token_url = 'https://cs57.salesforce.com/services/oauth2/token';

    $curl = curl_init();
    curl_setopt_array($curl, array(
        CURLOPT_HEADER => false,
        CURLOPT_URL => $token_url,
        CURLAUTH_ANY => true,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $postData

    $json_response = curl_exec($curl);

    $status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $response = json_decode($json_response,true);

And the response I get is

Array ( [access_token] => my token 
        [instance_url] => https://cs57.salesforce.com 
        [id] => https://test.salesforce.com/id/00D0k0000000Xu2EAE/0057F000000q8KFQAY 
        [token_type] => Bearer 
        [issued_at] => 1503288742327 
        [signature] => wt/b1QFLd8EJmIx6Max8rW2xmovdj3q/onMdKfExAqo= 

As per the salesforce docs I should get refresh token also. But why I am not getting it. Or do I miss something here?


It seems like, I asked a very dump question. I was following ' username-password authentication flow ' and the doc clearly says

" This OAuth authentication flow passes the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token is issued. "

  • You need to set an offline scope – Eric Aug 21 '17 at 4:57
  • For the connected app, already i have given : 1)Full access (full) 2) Perform requests on your behalf at any time (refresh_token, offline_access). Also set Callback URL: ap5.salesforce.com/services/oauth2/token. I am initiating the API request from my local system(Desktop system), is that a problem? – sajeesh Aug 21 '17 at 5:28

This has always been the best guide to oAuth for me: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com

Re refresh tokens, see this section: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com#Token_Refresh

But yes, it depends on the type of flow you are using, and how the Connected App is configured. But a Web Server Flow or User Agent flow should return one.


Despite many hours of increasing desperation, I have never been able to find a way to get a refresh token from the initial authorization flow, as it is implied should happen by the above answer and others like it. The only thing that has worked for me is:

curl -v -L \
 -F 'response_type=token' \
 -F 'client_id=<consumer key of connected app>' \
 -F 'redirect_uri=https://login.salesforce.com/services/oauth2/success' \
 -F 'scope=refresh_token <any other scopes you need>' \
 -F 'prompt=consent' \

This in my case delivers a 302 redirect response. Put the redirect URL returned into your browser, and it will take you to a Salesforce login followed by an oauth opt-in page. Click ok, and then your refresh token appears in the URI in the browser tab. It may be scrolled out of view so if you can't see it, scroll to the right.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.