I am performing Server-Server communication between Salesforce and a Portal I am developing.

I implemented the JWT Flow as follows:

  • Created connected app and digitally signed it with certificate
  • Implemented JWT get authentication token: I am sending authentication request and I am getting back an access_token
  • I am using the access token to communicate with salesforce (create, update, get,...)

But the access_token is getting expired daily. How I can make this token serve for ever, or at least for a very long time.

  • I checked the link, its a bit different than my case. Derek answer is helpful in my case. Thanks! Commented Aug 27, 2019 at 6:04

1 Answer 1


The length of time that your access token is valid is determined by the session timeout value in the Connected App's policies. By default, I believe that this timeout is not set, in which case the Connected App defaults to the session timeout policy of your target org (Setup -> Security -> Sessions Settings in LEX).

The session timeout is reset every time you make a request with a given access token, so if your portal is active enough, you don't really need to worry about it.

This approach, however, sacrifices security. Better practice, I believe, would be to set a very short timeout, and assume that your access token is always invalid and go through the JWT flow for each request. If the access token isn't expired yet, going through the JWT flow will return the same token.

An alternative approach would be to try to make a request using the current token, handling the auth error (if one is returned), and using that as your indicator to make request for a new access token.

  • But the session setting has only the option to extend the session timeout to 24hr and not more. So if my system was idle for a 24hr it will expire, and then I should perform a refresh token flow. Is that correct? Commented Aug 27, 2019 at 6:11
  • 1
    @AliBasheer Nope, the JWT flow isn't one that uses refresh tokens. You'd just make another request for a token using the same JWT flow that you used to get the previous (now expired) token.
    – Derek F
    Commented Aug 27, 2019 at 11:28
  • Alright Derek! Thank you! Commented Aug 28, 2019 at 12:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .