I am very new to the Salesforce API. I am creating a library which connects to Salesforce and accesses data etc.

I am implementing the Web Server Oauth Authentication workflow (https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_web_server_oauth_flow.htm), with the understanding that it differs from the Username-Password workflow in that you shouldn't have to log in each time.

My understanding was that since the client secret is stored on the server, once a connection between the server and Salesforce instances occurs, login credentials are no longer necessary.

I am finding that this is not the case. Every time the Salesforce session expires, my API call first redirects to Salesforce, asks for username/password, and then it can move forward.

Am I using the incorrect workflow? Are there some settings I'm missing in my REST App configuration?

Here is a my authorization URL:


I am implementing the Web Server Oauth Authentication workflow with the understanding that it differs from the Username-Password workflow in that you shouldn't have to log in each time.

That's not correct. With an OAuth flow, you get a token, which you can utilize to login to any system. A token signifies that you are authorized to perform operations based on behalf of an authenticated user.

Tokens will always expire. It just depends upon the maximum expiration limit, which you can set up to 24 hours. So as soon as your token expires, you will need to authenticate yourself again to be able to get a new token.

With the Web Server OAuth Authentication Flow, what you do is that you get a refresh token, which is as good as your username/password, so you should be carefully storing that somewhere. And that in this flow, you can generate a new token whenever it expires by just using the refresh token, instead of sending the username and password with the request.

Apps that are hosted on a secure server use the web server authentication flow. A critical aspect of the web server flow is that the server must be able to protect the consumer secret.

Take a look at How Does the OAuth Refresh Token Fit Into the Authentication Flow?, which explains how you can use refresh token to get a new token whenever it expires.

Both the web server OAuth authentication flow and user-agent flow provide a refresh token that can be used to get a new access token. Access tokens have a limited lifetime specified by the session timeout in Salesforce. If an application uses an expired access token, a “Session expired or invalid” error is returned. If the application is using the web server or user-agent OAuth authentication flow, a refresh token is provided during authorization. Use this refresh token to get a new access token.

  • Thanks! I knew there was something I was missing, wasn't sure where. Will definitely work on implementing this. – user1015214 Nov 2 '18 at 13:24
  • I started looking into this, and found this in the docs: "The refresh token is only returned if the redirect URI is login.salesforce.com/services/oauth2/success or used with a custom protocol that is not HTTPS." I'm confused about this, I have my redirect URI set to be a point on my website, why would I use a salesforce URI? And I don't really understand the point about a custom protocol, can you explain this? – user1015214 Nov 7 '18 at 18:07
  • 1
    That classifies as a separate question, so you should open one with as much details you can provide and someone should be able to help you. – Jayant Das Nov 7 '18 at 18:09
  • I figured it out, I just needed to pass the 'refresh_token' in the scope parameter of the authorization call, and also set up app to have that permission as well. – user1015214 Nov 7 '18 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.