I am trying to implement Web Server OAuth flow from one Salesforce Org to another.

Following is the Class which contains the logic. I am hitting custom rest api to insert Accounts using the access token.

public class WebServerFlow{

public string ep1='https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=3MVG9d8..z.hDcPKBH.vazxgP2a3pz_hHw3pDYxj0JvosDjiE0opFXBmhsLdlFHyEZIWZ07FKfbvEivZvgCry&redirect_uri=https://c.ap8.visual.force.com/apex/WebServerFlow';

public string code{get;set;}
public void tokenizer(){
    Pagereference pg =null;
    String token = 'https://login.salesforce.com/services/oauth2/token'+'?grant_type=authorization_code&client_secret=*******&client_id=3MVG9d8..z.hDcPKBH.vazxgP2a3pz_hHw3pDYxj0JvosDjiE0opFXBmhsLdlFHyEZIWZ07FKfbvEivZvgCry&redirect_uri=https://c.ap8.visual.force.com/apex/WebServerFlow&code='+code;    
    Http h = new Http();
    HttpRequest req = new HttpRequest();
    HttpResponse res = h.send(req);   
    wrapper w = new wrapper();
    w = (wrapper)JSON.deserialize(res.getBody(),wrapper.class);

    string url = 'https://starhunter-dev-ed.my.salesforce.com/services/apexrest/Account123';   
    HttpRequest req2 = new HttpRequest();
    req2.setHeader('Authorization','Bearer '+w.access_token);
    req2.setBody('{"name":"Starhunte","phone":"1234567890","website":"http://[email protected]"}');
    Http ht = new Http();
    HttpResponse resp2 = ht.send(req2);


public WebServerFlow(){
    code = ApexPages.currentPage().getParameters().get('code');    
public pageReference callLogin(){
    Pagereference pg= new PageReference(ep1);
    return pg;

public class wrapper{
    public string access_token;
    public string signature;
    public string scope;
    public string id_token; 
    public string instance_url;
    public string id;
    public string token_type;
    public string issued_at;

The VF Page is:

<apex:page controller="WebServerFlow" >
 <apex:form >
     <apex:commandButton value="click to callout" action="{!callLogin}" />
     <apex:commandButton value="click to tokenize" action="{!tokenizer}" />           

Following are the issues I am facing. I have tried to follow some of the existing posts but they are not working.

I am able to receive the access token but not the refresh token. But on trying to use this access token to hit custom rest api , I am getting the error : [{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}] I checked the session settings and the validity of access tokens is well within limits.

I tried to change the Endpoint to the instance_url returned in the response but it throws another error: LOGIN_OAUTH_INVALID_TOKEN

The response does not return refresh token. I added scope=refresh_token in the authorize step. But that throws another error:OAUTH_APPROVAL_ERROR_GENERIC : An unexpected error has occured during authentication.

  • Is the code you get in step 1 vallid? as the code is sent to callback url Commented Jan 19, 2019 at 21:32
  • Yes the code is valid. Using the same code I am receiving access token
    – starhunter
    Commented Jan 20, 2019 at 6:35


You must log in to answer this question.

Browse other questions tagged .