This is about JTW token for which my understanding is it last for long and can be used in automation/background process.

For one of the project I generated the JWT token (https://help.salesforce.com/articleView?id=remoteaccess_oauth_jwt_flow.htm&type=5) by setting up the exiry to 2020. I was expecting this token will last until 2020. But apparently I found that it depends on org's session policy setting.

There is another system which calls salesforce api with the JWT token. After generating the JWT access token it is hardcoded in that system's setting. There is no mechanism through which we can get new access token if it gets expired.

Can anyone put more insight into this?

Thanks in advance.


As you've learned, the exp that you pass as part of the JWT claims (the thing you use to get the access token) doesn't have anything to do with how long the access token is valid for.

Instead, the exp parameter controls how long your JWT (though I think you're technically sending a JWS, JSON Web Signature, to Salesforce) is valid for. If your JWT gets to Salesforce, and Salesforce's server time is beyond that of the exp timestamp, then Salesforce will reject the JWT.

The validity of your access token is based on one of two session timeout policies.

  • Salesforce will first check to see if there's a specific session policy for the connected app that you're using to access Salesforce
  • Failing that, Salesforce will default to the org-level session policy

If you make an api call using a given access token before it expires, the access token's expiration timer will be reset.

So while you can, theoretically, keep making requests at regular intervals to keep an access token fresh, that's not something I would rely on. Hardcoding things is usually a red flag. A well-built, robust system that is making calls to Salesforce should have a mechanism to detect whether or not the access token is expired, and to get a new access token if that happens.

The simplest such mechanism is to simply try to get a new access token before every call to Salesforce. If your current access token is still valid, Salesforce will simply return the same access token you already had (prior to sending a new JWT to Salesforce).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.