I created one connected app in Salesforce. I am doing every time two callout one for outh2.0 and another for actual apexrest callout. I want to avoid outh2.0 callout every time. The following solution in my mind but facing some issue. 1- Use refresh token to get a new access token 2- Use expire time limit of the access token to make a new callout for authentication.

The problem I facing.

  • When the first time I make a callout for authentication like Outh2.0 I am getting a successful response but I need refresh token. so with the help of refresh token, I can make a call out for new authenticate access token when the previous access token is invalid.

  • I am also not getting time limit of the access token, generally other outh2.0 we are getting the expire_in key in response but through the connected app, I am not getting such type of key

Let me know if there is another way to authenticate and not call every time for authentication to avoid redendency.

here is my code for outh

String reqbody = 'grant_type=password&client_id='+clientId+'&client_secret='+clientSecret+'&username='+username+'&password='+password;
    Http h= new Http();
    HttpRequest req= new HttpRequest();
    HttpResponse res=h.send(req);

2 Answers 2


To use OAuth2:

  • Create your connected app. Make sure to enable OAuth2 and choose the right scopes.
  • If you need a refresh token, make sure to include the scope "Perform requests on your behalf at any time (refresh_token, offline_access)".

Now, you do the OAuth2 handshake in two steps:

  1. Retrieve the code you need in step (2). Navigate in a browser to https://login.salesforce.com/services/oauth2/authorize?response_type=code&redirect_uri=https://login.salesforce.com/services/oauth2/callback&client_id=<ConnectedAppClientID>. This will ask for your permission to connect the APP to you Salesforce Org. Once you Approve, it will redirect to the provided "redirect_uri" with a single usage "code". Make sure to use the same redirect uri as the one used for creating the connected app.
  2. Now, POST https://login.salesforce.com/services/oauth2/token?grant_type=authorization_code&redirect_uri=https://login.salesforce.com/services/oauth2/callback&client_id=<ConnectedAppClientID>&client_secret=ConnectedAppSecret&code=<CodeFromStep1>. This will return you the refresh token in JSON format. There is also an access token token with the response. So you can use it until it expires.

Store the refresh token and next time you don't need the "manual" handshake. To get an access token, POST https://login.salesforce.com/services/oauth2/token?grant_type=refresh_token&client_id=<ConnectedAppClientID>&client_secret=ConnectedAppSecret&refresh_token=<RefreshToken>

Note: for a sandbox, replace login.salesforce.com with test.salesforce.com.

  • how long this access token is valid ?
    – brahma
    Commented Feb 23, 2021 at 14:58
  • This should answer your question: salesforce.stackexchange.com/questions/73512/…
    – Denis S.
    Commented Feb 24, 2021 at 16:39
  • thanks, when I use this taken it says the " "this session is not valid for use with the rest api" with session id expired issue. I tried editing policies and etc but nothing solved, what particular setting you could think of ?
    – brahma
    Commented Feb 24, 2021 at 20:05
  • hmmm, maybe your user does not have access to make API calls? Make sure you have the permission "API Enabled". It is given via a Profile or a Permission Set. Also, make sure there are no IP restrictions in your Salesforce organization and in the connected app configuration you have created.
    – Denis S.
    Commented Mar 1, 2021 at 18:33
  • I use the same url format in 2. , but it doesn't return refresh token, only access token
    – Matt
    Commented Apr 13, 2023 at 9:34

The "password" grant type does not provide a refresh token. You would need to use one of the other OAuth2 flows. Also, sessions in Salesforce do not expire as long as they are used at least once every session timeout period (e.g. if the timeout is 30 minutes, it will be extended as long as there's at least one API call every 30 minutes). You may want to use a Named Credential, which manages the session token for you (including refresh tokens).

  • i tried with grant_type = authorization_code. but in this there is one code parameter i don't what is that. here is a link developer.salesforce.com/docs/atlas.en-us.api_rest.meta/… on point 4
    – Sarvesh
    Commented Feb 26, 2019 at 12:25
  • @sarveshkumar The web server flow has the user go to Salesforce, authenticate and grant access, then a code is returned to the server; the server then exchanges this code for an access token. Every flow that grants a refresh token requires a web browser login initially. You would need to create a Visualforce page or Lightning App to complete the initial login. Afterwards, you can use the refresh token to renew a session.
    – sfdcfox
    Commented Feb 26, 2019 at 12:31
  • I am doing S2S integration to sync the data between two different org using REST API via connected App. So no picture of any UI thing all i need to handle in backend APEX only
    – Sarvesh
    Commented Feb 26, 2019 at 12:38
  • @sarveshkumar Use a Named Credential for this purpose.
    – sfdcfox
    Commented Feb 26, 2019 at 12:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .