I have been googling a lot about the fact how to get a refresh token. I have rest integration between salesforce to salesforce and it is working fine. After few hours not using the service I get this message in my debug log : message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}] I totally understand why it is happening ( cause every access has some time limit ). Now i want to request for the refresh token ( I understood by reading multiple articles. sample). In order to request for a refresh token, we should pass some parameters as mentioned below.

POST /services/oauth2/token HTTP/1.1
Host: https://login.salesforce.com/ 
&refresh_token=***your token here*** 

But just wanted to know that from where I get &refresh_token=your token here mentioned in the above sample code.

The rest integration is setup using Named credentials and Auth providers.

As a work around now, when the session is expired every time, I go to connected app and re-authenticate and my code works just fine.

My goal here is, when i face this Session Expired message, i should be able refresh the token withing the same class where i am invoking the rest service so that other piece of logic works fine. please let me know if anyone has suggestions.

  • Please tell me client id and client secret are not the actual client ids and secrets of your organization ! Oct 7, 2017 at 5:28
  • If you are using named credentials it should be managing it for you. If you are making soap calls then there is a bug when the acces token expires where it does not refresh. If you call a rest endpoint first it will grab a new access token
    – Eric
    Oct 7, 2017 at 7:47
  • 3
    As your secret key is still visible in the edition history, if it was a real key which I suspect, I seriously advise you to deactivate asap and definitely this connected app (or regenerate a key but I'm not sure if it's possible) because those credentials could let anyone access and edit your org data / metadata Oct 7, 2017 at 8:03
  • @emmanuel Nopes that’s just the dummy code I got from salesforce documents Oct 7, 2017 at 11:55

1 Answer 1


@Eric you are correct. using naming conventions does manages the refresh logic. However i was wrong while selecting the scopes. initially I had selected as follows.

Under Named Credentials ==> Scope = full later changed it to full refresh_token

OAuth remained same.

Connecte App: Selected OAuth Scopes ==> full and refresh_token,offline_access

This solved my problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.