I'm using the User-Agent flow, and I successfully get back a, access_token. From here I have no way to determine when this token expires.

I was hoping, that calling the https://test.salesforce.com/services/oauth2/userinfo endpoint would return to me when the token expires. But it does not.


There is no way to tell, because ironically, the act of checking the expiry would reset the token's expiry. Access tokens, like session Id values, are extended each time a request is made and half of the remaining session time is left. For example, if the expiry time is 30 minutes, and you log in, wait 16 minutes, and make a new request, then you will again have 30 minutes before it expires. This is how users can continue to work all day as long as they are working, but are automatically logged out when they stop working. For all login flows, you must expect the possibility that a 403 Forbidden will be returned at any time, and handle the situation appropriately. Remember a user can log out early via Salesforce, or an administrator can kill the session early. You must consider this a fairly normal situation, not something to avoid.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.