I am working on an application that requires REST API access via oauth to a large number of salesforce orgs. I need to refresh the access tokens on a timer rather than the traditional access token -> 4xx -> refresh flow. How often am I allowed to refresh the token? I ask because I am getting a large number of invalid_grant errors on refresh token calls.


There's a limit of 3,600 logins per user per hour, so setting a timer of even one second should suffice. Keep in mind that if you have multiple apps logging in, the value is cumulative across all logins. Realistically, you should wait at least 10 minutes between refreshes, because it's not possible for sessions to expire sooner than 15 minutes (other than being manually expired/logged out). I'm not sure what you're trying to do, but it might be a better idea to just perform a GetServerTimestamp call every 10 minutes instead of trying to get a new access token; as long as you're using the token, it will not normally expire.

  • thanks for the info, that is good to know. I am currently only refreshing the token once per hour, but I am still getting a large number of refresh failures. It is odd because the token refresh will fail with invalid_grant expired access/refresh token when I try to refresh, but then later on the refresh is successful without requiring reauthentication. – phatpenguin Feb 6 '18 at 6:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.