The usecase is very simple

  1. I have a client app SPA in Angular(APTTUS eCommerce) using Salesforce Login for User SignIn.

  2. I need to call a backend API(custom c# application) from the SPA to fetch data and show it to the user. I can pass the salesforce access token to the backend API.

QQ: How can the backend API validate the access token generated by salesforce? Is there a Key or Certificate or URL salesforce provides for me to validate the token in c# app and return data?

(Other Q: What claims does salesforce access token have vs Salesforce Identity token)


There's no real reason to "validate" the token. If you get a 403 error when using it, the token isn't valid (and the response will tell you why). When you obtain an access token, you can parse the response to check out the scopes. The scope tells you what you're allowed to do. Note that the scope will be the intersection of whatever you request and whatever you're allowed to do (e.g. if you request the "full" scope, but the app doesn't allow that scope, you can't have full access).

  • You need the Issuer Signing Key to validate the token- make sure signature is not altered with. That avoids calling a endpoint to validate the token. I am not sure why you say no real reason to validate the token? – Amyn Jul 23 '20 at 16:37
  • Maybe its in YOUR_DOMAIN/.well-known/openid-configuration ...just need some confirmations – Amyn Jul 23 '20 at 16:50
  • @Amyn You can call the Identity URL (/id/org-id/user-id) provided in the authorization response, which includes a lot of additional details as well. – sfdcfox Jul 23 '20 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.