I've begin working with Named Credential and Authentication Provider for the first time and I'm a bit lost on the authentication process and the refresh token functionalities.

I'm going to add to my managed package this named credential in order for our subscribers to authenticate to their service and allow us to make some callouts to it.

  1. My first question is, can I trigger the authentication flow from another point (e.g: Visualforce page) other than setup? I don't want my subscribers to go to Setup > Security > Named Credentials > Edit > Save in order to start this process.
  2. How can I get the access token and 'update' the Name Credential every N days to renew it before it expires?


  • After I ran the authentication flow the name credential displays the following message The authentication provider didn't provide a refresh token. If the access token expires, your org won't be able to access this named credential.
  • I'm integrating with Square and they say I need to renew the access token every 30 days by making a call to POST /oauth2/clients/{client_id}/access-token/renew

Currently, Named Credential refreshes access token only if Refresh token was provided otherwise not. Recently, I got stuck with same issue while developing integration with Instagram and I had to opt the custom solution by using custom setting and Visualforce page.

Actually, Salesforce is following a standard option to refresh the token, they can not provide a customized URL/option to refresh it for each external system....if each system has it's own syntax to refresh token then how Salesforce would handle that for each individual system.

  • Thank you Ayub, would you mind elaborating a bit on the solution you implemented for an OAuth 2.0 connection to an external service with the custom setting and vf page? – Jose May 7 '18 at 20:30
  • I had to develop custom code using http callouts :( – Ayub Jan 9 '20 at 6:52

just add to scope (in named credentials and/or auth provider): refresh_token full

Named credentials config

  • Hi Jacek, that would only work if the external system implemented the standard "refresh_token" that Salesforce supports (That at the time of the question Square didn't). We actually end up implementing a custom OAuth 2.0 integration to get this working properly. – Jose Jan 8 '20 at 22:26
  • I'm getting an OAuth "generic" error when I add refresh_token or refresh_token full to the scope. It takes me to the login flow, but then generates the error screen. The record has saved the new scipe, but the Authentication Status is pending. FYI, this is just for accessing this same ORG for tooling API access from Apex. – PatMcClellan__c Dec 8 '20 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.