I am facing an issue with the named credential platform functionality in the following integration scenario:

The Salesforce Org is supposed to perform Rest callouts to a 3rd party service. Authentication is set up with a named credential (Named Principal, OAuth2) using an Open ID Connect-authentication provider. The 3rd party service uses WSO2 identity server.

Expected Behavior
After setting up the named credential successfully by performing the OAuth flow initially, the platform feature encapsulates all further handling with refresh tokens etc from the user. Apex code can simply use the established authentication as described in the reference

Actual Behavior
After setting up the named credential initially, callouts from apex code work fine, until the token expires after 24hrs. Then I receive the following response body from the 3rd party service for callouts that worked fine before:

{"message":"No Authorization header","statusCode":401,"error":"Unauthorized"}

I can try to perform callouts, and it consistently returns the 401 (No matter if POST, GET and different resources. So it does not seem to be the issue described in this post). The only "workaround" is to start the OAuth Flow again using the "Start Authentication Flow on Save"-setting in the named credential.
Being only an inconvenience during development, this behavior is not acceptable for productive use in an app exchange application.

Does anybody have an idea what the issue could be? Are there known issues between Named credentials/Auth provider vs WSO2 identity server?

Thanks in advance for your help!


If you use 2 times the same refresh token to get the access token you will have a body like the described. The refresh token can only be used one time.


In the Named Credential you should set Scope to refresh_token.

enter image description here


Sounds like could be this https://help.salesforce.com/articleView?id=000313355&type=1&mode=1

I had a similar issue and we fixed it using the workaround described in the article.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.