1

I am using the OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration to authenticate my connected app.

My redirect Url is:

https://login.salesforce.com/services/oauth2/authorize?
client_id=<CLIENT_ID>&
redirect_uri=<HOST_URL>/services/oauth2/success&
response_type=token&
scope=full refresh_token

I get this error:

error=invalid_scope&
error_description=the requested scope is not available

If I use scope=full, I am able to login and get the access token, but not the refresh token.

As per this answer, using redirect_uri=http://localhost works as expected, but I want to redirect to my webapp.

This answer suggests using http:// instead of https:// for the callback url scheme, but Salesforce gives the error:
Callback URL: Cannot be an HTTP url.

Thank you for your time.

5
  • @identigral Yes. Thanks! So, are you suggesting that I use a web-server flow even though my app is entirely client side? – Kartik Soneji Apr 15 '20 at 21:22
  • Yes, that's the way to go – identigral Apr 15 '20 at 21:30
  • OK. Thanks once again. – Kartik Soneji Apr 15 '20 at 21:35
  • How did you solve ths? – zaitsman Mar 11 at 23:03
  • @zaitsman By using the web-server flow for the app. I couldn't get the refresh token with the user-agent flow. – Kartik Soneji Mar 12 at 5:39
1

To get a refresh token, you need to use the Web Server flow for your web app. This uses the grant type of "authorization_code" instead of "token." This is the appropriate flow to use for web apps. This process actually involves two steps, first getting an authorization code, then trading that code for an access token and refresh token.

5
  • 1
    But the documentation mentions that the response can contain a refresh token (The refresh token for the user-agent flow is only issued if you requested scope=refresh_token). – Kartik Soneji Apr 15 '20 at 15:41
  • @KartikSoneji Did you set this scope as available in your connected app? You can't request a scope that's not configured in the connected app. Aside from that, you did say you're using a web app, right? Why would you use the wrong flow? Use the correct flow for your use case, as not doing so is technically a security risk. – sfdcfox Apr 15 '20 at 15:52
  • Yes. In fact, I even tried enabling ALL scopes, but to no avail. I am developing a client side web app, without a server. The documentation, recommends using the User Agent flow for Client apps running in a browser using a scripting language such as JavaScript. Is this not the right flow for my use case? – Kartik Soneji Apr 15 '20 at 16:03
  • @KartikSoneji I apologize, that wasn't mentioned in the original question, so when you said webapp, I presumed you meant something running on a server. In your case, if you can use a WebView or iframe, and detect when that container reaches the callback URL, you can use the User-Agent Flow. It's not possible to redirect to any URL and get a refresh token, as a security measure. The rules for the refresh token are laid out in the doc you linked. – sfdcfox Apr 15 '20 at 16:16
  • @sdfcfox No problem. I should have been more clear in my question. But the documentation mentions that a refresh_token will be returned if The redirect URL host matches the request host and includes the servlet services/oauth2/success. – Kartik Soneji Apr 15 '20 at 16:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.