I'm trying to get the refresh_token flow working to obtain a new access token but I always get this error:

{"error_description":"expired access/refresh token","error":"invalid_grant"}

I'm authenticating with "refresh_token api" as my scope using the web server flow with salesforce. As I've seen in other posts, I've made sure my application is configured to allow users to reuse the app without being forced to log in again. My CURL command to request the new token looks like this:

curl -v -X POST https://test.salesforce.com/services/oauth2/token -d "grant_type=refresh_token&refresh_token=$refresh_token=&client_id=$client_id&client_secret=$client_secret"

with the correct strings interpolated of course. Any ideas what I might be doing wrong>

  • 3
    I encountered this as well and it just ended up being my own doing. Revoke remote access on the user you are trying to login/refresh as, double check client_id, client_secret, that test.salesforce.com is the correct endpoint, and that the refresh token that you are using originates from test.salesforce.com. – Phil Rymek Jan 28 '14 at 19:37
  • Was this ever resolved? I'm currently having the same issue and have verified the endpoints are properly set. – jonnybro Feb 24 '16 at 17:57

I noticed that you have "test.salesforce.com" hardcoded. As Phil mentioned in his comment, you should verify that this is the correct endpoint for the token you are using. For production, you should use "login.salesforce.com" so you may need logic to switch this as needed.

Additionally, you should check the values of the variables being used and the final output string to see if there is a URL encoding issue. For example, the additional "=" in your parameter string after "$refresh_token" will likely cause an issue:

curl -v -X POST https://test.salesforce.com/services/oauth2/token -d "grant_type=refresh_token&refresh_token=$refresh_token=&client_id=$client_id&client_secret=$client_secret"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.