We have a product that allows our customers to do a basic integration with Salesforce. This integration allows them to track time in our software against Tasks and Opportunities in their Salesforce account.
When using OAuth to authenticate users the tokens for some customers only last a short amount of time ( a week, or sometimes a few hours) and then expire.. However we
- do not receive always receive refresh token to the token fetch
- never receive an expires_in response to the token fetch thus we have no clue when we should refresh the token.
- which every other single piece of software we integrate with returns this information if they use a refresh token as recommended per the OAuth 2.0 spec
This means our customers are constantly having to re-authenticate their Salesforce integration with our software.
Is this a mis-configuration of our OAuth app or some deficiency of the Salesforce OAuth2 implementation?
