I have a cron-job that's running against my SalesForce account daily.

According to my understanding, i can't use the same access token i receive from SF every day for a period of a long time (say a few months), it will expire at some point (according to my policy), right?

So what about the refresh token? Is that the solution i should use? If i ask SF for a refresh token, it won't expire?

In that case, should i just ask for an access token using my refresh token, try to send my REST API post request with that access token until i see it expires (when i get an error), and then request for a new access token using the refresh token?

Just looking for a clarification.



Refresh tokens have a different policy than access tokens, which are basically session IDs. Access tokens follow the rules for session IDs, meaning they can last up to 24 hours without usage. Conversely, refresh tokens can last indefinitely if configured to do so, and if permitted by the Connected App settings. Assuming you set your refresh token to last indefinitely, your app can use the token indefinitely, even if you change the username or password on the user (but, obviously, not if the user is deactivated or frozen).

However, notice I said that access tokens last until they are not used for a certain period of time. This means you could actually write a second cron job that simply calls "getServerTimestamp" or something periodically (smaller than your expiration time setting) and your access token will remain valid indefinitely. However, since the maximum time is 24 hours, your cron job would be running in to a race condition to use the access token before it expires (~1 second window). If you don't want to keep tabs of a refresh token, it would be slightly more efficient to simply to simply set a cron job that calls the server hourly just to keep the session alive.

As for using the refresh token, you have it basically correct. If you get a 403 error, you request a new access token and try again. You may still want to write additional logic to notify you if the refresh token also expires. This may happen because someone explicitly logs it out in the Session Management or OAuth Session screens.

  • Great, thanks! I just don't understand - how is setting a cron-job more efficient than just creating a refresh token and set it to last indefinitely? Which also brings me to my next question - how do i get the refresh token? (i'm new to SF) Jan 16 '18 at 18:30
  • 1
    @gambitche2017 It's not necessarily more efficient, but it's less code. Active sessions are not expired sessions. To get a refresh token, you need to specify the scope refresh_token. It will be presented to you in your login response (using whichever flow you're using). Note that you cannot get a refresh token when using username/password flows. It has to be a real OAuth flow to get a refresh token. It's all in the documentation. Getting a refresh token is significantly more work than you'd imagine. Or, depending on what you're doing, maybe use "sfdx"?
    – sfdcfox
    Jan 16 '18 at 18:40
  • Why is getting a refresh token a hard work? Isn't it just sending a request to https://test.salesforce.com/services/oauth2/token with the appropriate credentials? Jan 16 '18 at 18:48
  • @gambitche2017 To get a refresh token, you have to send them to https://login.salesforce.com/services/oauth2/authorize in a web browser, set up an ad-hoc web server to listen to http://localhost:19876/callback (or whatever you like), wait for the the user to authorize and grant access, then process the response from the callback. You can't just do the entire thing in a CLI very easily.
    – sfdcfox
    Jan 16 '18 at 18:55
  • Oh wow, ok.. is there a documentation for this anywhere? i couldn't find it. Thanks for your help! Jan 16 '18 at 18:58

Refresh token is valid until revoked. When you request an access token, it gives you the time it was issued at. Based upon your session timeout setting, you can calculate when to request a new access token with the refresh token. https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_web_server_oauth_flow.htm

  • The refresh token can only get revoked manually by the admin, for example? it doesn't have a set expiration date like the access token? And how do i get the refresh token? Jan 16 '18 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.