A Salesforce instance is configured so that users can log in using OpenID Connect and their Google credentials.

I am trying to access the token provisioned by the login via google to make callouts to the Google APIs that I can request access to by using the Auth Providers scope parameter.

The getAccessToken method in Auth.AuthToken class is documented as being able to

Returns an access token for the current user using the specified 18-character identifier of an Auth. Provider definition in your organization and the name of the provider, such as Salesforce or Facebook.


I find that the token returned by this method can be used successfully by a user for a certain amount of time after login (I haven't timed it yet), but eventually it ceases to work, and the Google callouts fail with a 401 Unauthorised response. Refreshing the Visualforce page with a controller that calls this class does not resolve the issue, only logging out and back in resolves it.

Google documentation at https://developers.google.com/accounts/docs/OAuth2Login#refresh-tokens suggests that access_type=offline needs to be specified in the initial login to request a refresh token that can be used to gain another access token once the first one expires.

There is no way to configure this parameter within the Salesforce UI (we can only change the scope of the token requested), and even if it could be there is no method to force a refresh.

Google's documentation states the the lifetime of the access token is returned when an access code is validated https://developers.google.com/accounts/docs/OAuth2Login#exchangecode, so salesforce could detect when the token expires and refresh it, and also it would be useful to provide an apex method to allow a developer to force a refresh.

Is the Auth.AuthToken class designed only to be used in the moments after login? Should I expect salesforce to refresh this token for me?

2 Answers 2


It turns out this gap is resolved in the Spring 14 Salesforce release.

--Edit 05/04/2024

Release notes are no longer accessible, but the method is documented Auth.AuthToken.refreshAccessToken()


--Edit 09/02/2014

The gap in the Salesforce functionality is resolved with the above method, but the functionality Google offers does not follow the OpenID connect standard which states that the scope requested should be offline_access.

As mentioned in the OP the parameter access_type=offline needs to be included in the parameters to the auth page for a refresh token to be returned by the token service. This needs to be appended to the Authorize Endpoint URL: https://accounts.google.com/o/oauth2/auth?access_type=offline

  • Hello @James, when you say token service, do you mean the refreshAccessToken method ? It looks like I have the same issue you had salesforce.stackexchange.com/questions/420252/… , thank you
    – AshBringer
    Apr 3 at 21:54
  • by "token service" I meant the 3rd party endpoint which will provide a fresh access token on calling "refreshAccessToken". You'll need to have requested offline access correctly, this post is a decade old and it's possible things have changed - did you check the links in the other response on this post?
    – James
    Apr 5 at 8:11

I know this post is old, but it still pops up as one of the most relevant results for this issue. It would appear that in addition to the best response, the following parameter is now optimal: access_type=offline&prompt=consent, so the auth url would look something like: https://accounts.google.com/o/oauth2/auth?access_type=offline&prompt=consent.

This works for me with salesforce and the google developer api, wheres without prompt=consent it would not.

relevant post on stackoverflow: https://stackoverflow.com/questions/8942340/get-refresh-token-google-api

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .