• What is the validity period of the access token? Does this validity change depending upon the flow(username-password, webserver, etc.) being used to procure them?

  • Is there any validity period for the refresh token issued?

  • 1
    Seems like you are seeking help for interview questions? – Raul Sep 21 '17 at 11:53
  • Cookie session = new Cookie(ACCESS_TOKEN, accessToken); session.setMaxAge(-1); //cookie not persistent, destroyed on browser exit – NITHESH K Sep 21 '17 at 12:02
  • @NITHESH Can you please elaborate what do you mean by this code. -Thanks Nagesh – Nagesh Borate Sep 26 '17 at 9:23
  • @NageshBorate Yes sure – NITHESH K Sep 26 '17 at 9:26

Use the username-password authentication flow to authenticate when the consumer already has the user’s credentials.

  • The application uses the user’s username and password to request an access token. This is done via an out-of-band POST request to the appropriate Salesforce token request endpoint, such as https://login.salesforce.com/services/oauth2/token

  • Access tokens have a limited lifetime specified by the session timeout in Salesforce. If an application uses an expired access token, a “Session expired or invalid” error is returned

  • If the application is using the Web server or user-agent OAuth authentication flows, a refresh token may be provided during authorization that can be used to get a new access token.

Keep in mind the following considerations when using the refresh token OAuth process:

  • The session timeout for an access token can be configured in Salesforce from Setup by entering Session Settings in the Quick Find box, then selecting Session Settings.

  • If the application uses the username-password OAuth authentication flow, no refresh token is issued, as the user cannot authorize the application in this flow. If the access token expires, the application using username-password OAuth flow must re-authenticate the user.

  • Thanks for the answer. So if I interpret your answer, in light of my question, then the usable life of an access token is determined by the "session timeout" configured, and is same irrespective of the flow(useragent, webserver, ...) used to obtain the access token. Is my interpretation correct? And your thoughts on the second question? Does refresh token have a lifetime? -Thanks Nagesh – Nagesh Borate Sep 26 '17 at 9:43
  • @NageshBorate A given user may only have 5 access tokens authorized for a given connected app. Since each refresh token can potentially issue an access token, they are counted in that total. The way to think about this is that only the most recent 5 authorizations are valid. When the user goes through login the sixth time, the oldest authorization is invalidated and that refresh token will no longer work – NITHESH K Sep 26 '17 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.