I am performing Server-Server communication between Salesforce and a Portal I am developing.

I implemented the JWT Flow as follows:

  • Created connected app and digitally signed it with certificate
  • Implemented JWT get authentication token: I am sending authentication request and I am getting back an access_token
  • I am using the access token to communicate with salesforce (create, update, get,...)

But the access_token is getting expired daily. How I can make this token serve for ever, or at least for a very long time.

  • I checked the link, its a bit different than my case. Derek answer is helpful in my case. Thanks! – Ali Basheer Aug 27 '19 at 6:04

The length of time that your access token is valid is determined by the session timeout value in the Connected App's policies. By default, I believe that this timeout is not set, in which case the Connected App defaults to the session timeout policy of your target org (Setup -> Security -> Sessions Settings in LEX).

The session timeout is reset every time you make a request with a given access token, so if your portal is active enough, you don't really need to worry about it.

This approach, however, sacrifices security. Better practice, I believe, would be to set a very short timeout, and assume that your access token is always invalid and go through the JWT flow for each request. If the access token isn't expired yet, going through the JWT flow will return the same token.

An alternative approach would be to try to make a request using the current token, handling the auth error (if one is returned), and using that as your indicator to make request for a new access token.

  • But the session setting has only the option to extend the session timeout to 24hr and not more. So if my system was idle for a 24hr it will expire, and then I should perform a refresh token flow. Is that correct? – Ali Basheer Aug 27 '19 at 6:11
  • @AliBasheer Nope, the JWT flow isn't one that uses refresh tokens. You'd just make another request for a token using the same JWT flow that you used to get the previous (now expired) token. – Derek F Aug 27 '19 at 11:28
  • Alright Derek! Thank you! – Ali Basheer Aug 28 '19 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.