1

I am currently working on exposing the SF data as an API so the external system can consume it. I created a account for the external system to access the data through the API. Salesforce provides the external system gets the Access/Bearer Token through OAuth to access the data from the instance. I am trying to understand how long the Access/Bearer token is valid. I tried looking in to the Session setting in my instance and found that Session time out is like below

enter image description here

Does this mean the Access/Bearer token is valid for 4 hours? Please help me understand this.

Improve this question
1
  • 1
    @SwatiMishra That is incorrect. Org-wide session settings can have an effect on access tokens granted through OAuth. – Derek F May 18 '20 at 12:16
4

Sessions (OAuth 2.0 or otherwise) don't really have a static point in time where you can say "this login is no longer valid". Instead, and as implied by the setting you've found, sessions can time out.

That means that if there is no activity in the session for the value specified as the timeout, then the session is ended (and you'd need to get a new token). However, if you take even a single action before your session times out, the timeout countdown starts over.

e.g.

  1. Token obtained at 05:00
  2. Session timeout is 4 hours, so session will end at 09:00 if no actions are performed
  3. An action is performed, using the token, at 08:45
  4. Session timeout is reset, session will now end at 12:45 if no actions are performed

Session timeout is controlled by the connected app that you used to get the token. If you don't set the timeout in the connected app, then it defaults to the timout set in the org-wide session settings.

Improve this answer
3
  • "Normal" sessions started from the web UI behave a bit differently, if memory serves. I haven't taken as deep a look into those, but I seem to recall something about Salesforce performing an activity check at some odd interval. Doesn't really apply to OAuth sessions, but just trowing this out there so people don't think this applies universally. – Derek F May 18 '20 at 12:28
  • Does this mean the external application using the connected App's Client ID and Client Secret to get the Access Token/ bearer can use it for 4 hours without having to get the call the login.salesforce.com/services/oauth2/token to regenerate the token.? – user81642 May 18 '20 at 13:32
  • 1
    @user81642 I think you've missed the point I made in my answer. That 4 hours is a timeout. The token is guaranteed to be valid for that length of time, and that 4 hour countdown is reset every time you use the token to perform an action. – Derek F May 18 '20 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.