OAuth 2.0 username-password flow: Is the access token long lived?

Question

I am a newbie to Salesforce. I am planning on implementing username-password OAuth 2.0 flow in my iOS app. I am getting access_token after calling https://login.salesforce.com/services/oauth2/token API. Is this token long lived? It seems there is no way to refresh this access_token. Can I use this in future without having to refresh it?

Answer 1

You should check the operation response and handle any exception. If the response is an 401 containing this JSON:

[ { message: 'Session expired or invalid'
  , errorCode: 'INVALID_SESSION_ID'
  }
]

, you could call a refresh_token flow like this :

However, you only get the refresh token from the Web server and User-Agent as is indicated here.

If the application uses the username-password OAuth authentication flow, no refresh token is issued, as the user cannot authorize the application in this flow. If the access token expires, the application using username-password OAuth flow must re-authenticate the user.

So, I think that after login using user-password flow, you should re-authenticate the user or change the flow.

Refresh Token

The refresh token may have an indefinite lifetime, persisting until explicitly revoked by the end-user. The client application can store the refresh token, using it to periodically obtain fresh access tokens, but should be careful to protect it against unauthorized access, since, like a password, it can be repeatedly used to gain access to the resource server. Since refresh tokens may expire or by revoked by the user outside the control of the client application, the client must handle failure to obtain an access token, typically by replaying the protocol from the start.

I recommend you to read this article of digging deeper into OAuth in force

Answer 2

The session timeout for an access token can be configured in Salesforce by logging into the account your app is configured with, and going here:

Setup | Administer | Security Controls | Session Settings

which was detailed on this page

You also need to make sure that your application is configured to give out a refresh_token, which is specified:

• in Selected OAuth Scopes with a value of Perform requests on your behalf at any time (refresh_token, offline_access), and can be found in your account under Setup | Build | Create | Apps

Info on Refresh Tokens at Salesforce

Note that your app has to send the request correctly as well. Passing the correct scope is required to get a refresh_token back, and valid scopes are detailed on this page