I am performing a rest callout to a 3rd party service. Authentication is set up with a named credential (Named Principal, OAuth2) using an Open ID Connect-authentication provider which uses WSO2 identity server.

Initially, callouts from apex code work fine, until the token expires after 24hrs. Then I am consistently receiving below error:

{"message":"unauthorized request, please refresh your access token","statusCode":401,"error":"Unauthorized"}

Named credentials

Auth Provider The only "workaround" is to start the OAuth Flow again using the "Start Authentication Flow on Save"-setting in the named credential.

Does anybody have an idea what the issue could be? This question is similar to question( Named Credential - Automatic refresh token does not work with WSO2 Identity server) but no response on that question too?

  • This seems to be expected behavior. Have you confirmed this with the service provider as how long the token is valid? If its valid for 24 hours, then you will need to fetch the token again and make the callout. Are you fetching the token prior of it expiring?
    – Jayant Das
    Jan 31 '19 at 2:06
  • 1
    Hi Jayant, Expected Behavior of named credentials with openid auth provider is as: After setting up the named credential successfully by performing the OAuth flow initially, the platform feature encapsulates all further handling with refresh tokens etc from the user. So once the token is expired it should fetch the new refresh token automatically when it receive 401 error. Jan 31 '19 at 7:53
  • 1
    Unless you have defined the Scope attribute as refresh_token. Is the Scope attribute configured this way in your Named Credential configuration?
    – Jayant Das
    Jan 31 '19 at 14:10
  • Thanks Jayant for the response. I have added screenshots of my configurations and I am using refresh_token scope in named credentials but it's still not working. After 24 hours once access token expires, its returning {"message":"unauthorized request, please refresh your access token","statusCode":401,"error":"Unauthorized"} error. Feb 2 '19 at 11:13

In the Named Credential you should set Scope to refresh_token.

enter image description here


In my case i had use Scope as refresh_token full

If we just use refresh_token then the endpoint will not allow us to call API

Note that the order of scope is also important.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.