I am not getting refresh token on outh2.0 using Connected App in salesforce

Question

I created one connected app in Salesforce. I am doing every time two callout one for outh2.0 and another for actual apexrest callout. I want to avoid outh2.0 callout every time. The following solution in my mind but facing some issue. 1- Use refresh token to get a new access token 2- Use expire time limit of the access token to make a new callout for authentication.

The problem I facing.

• When the first time I make a callout for authentication like Outh2.0 I am getting a successful response but I need refresh token. so with the help of refresh token, I can make a call out for new authenticate access token when the previous access token is invalid.

• I am also not getting time limit of the access token, generally other outh2.0 we are getting the expire_in key in response but through the connected app, I am not getting such type of key

Let me know if there is another way to authenticate and not call every time for authentication to avoid redendency.

here is my code for outh

String reqbody = 'grant_type=password&client_id='+clientId+'&client_secret='+clientSecret+'&username='+username+'&password='+password;
    Http h= new Http();
    HttpRequest req= new HttpRequest();
    req.setBody(reqbody);
    req.setMethod('POST');
    req.setEndpoint('https://test.salesforce.com/services/oauth2/token');
    HttpResponse res=h.send(req);

Answer 1

To use OAuth2:

• Create your connected app. Make sure to enable OAuth2 and choose the right scopes.
• If you need a refresh token, make sure to include the scope "Perform requests on your behalf at any time (refresh_token, offline_access)".

Now, you do the OAuth2 handshake in two steps:

1. Retrieve the code you need in step (2). Navigate in a browser to https://login.salesforce.com/services/oauth2/authorize?response_type=code&redirect_uri=https://login.salesforce.com/services/oauth2/callback&client_id=<ConnectedAppClientID>. This will ask for your permission to connect the APP to you Salesforce Org. Once you Approve, it will redirect to the provided "redirect_uri" with a single usage "code". Make sure to use the same redirect uri as the one used for creating the connected app.
2. Now, POST https://login.salesforce.com/services/oauth2/token?grant_type=authorization_code&redirect_uri=https://login.salesforce.com/services/oauth2/callback&client_id=<ConnectedAppClientID>&client_secret=ConnectedAppSecret&code=<CodeFromStep1>. This will return you the refresh token in JSON format. There is also an access token token with the response. So you can use it until it expires.

Store the refresh token and next time you don't need the "manual" handshake. To get an access token, POST https://login.salesforce.com/services/oauth2/token?grant_type=refresh_token&client_id=<ConnectedAppClientID>&client_secret=ConnectedAppSecret&refresh_token=<RefreshToken>

Note: for a sandbox, replace login.salesforce.com with test.salesforce.com.

Answer 2

The "password" grant type does not provide a refresh token. You would need to use one of the other OAuth2 flows. Also, sessions in Salesforce do not expire as long as they are used at least once every session timeout period (e.g. if the timeout is 30 minutes, it will be extended as long as there's at least one API call every 30 minutes). You may want to use a Named Credential, which manages the session token for you (including refresh tokens).