From the documentation I understand that the answer is yes:


But if I try I can't get it.

I am working on a web application that allows any user to connect with its salesforce account.

I've implemented User-Agent Flow and I obtain correctly access_token and other info but I can't obtain refresh_token, even if I have the correct scopes (api, web, refresh_token, offline_access).

This is my request:


And my redirect URL is: http://[MYSITE].com/#/services/oauth2/success

(that corresponds to the host from where I make the call)

This call correctly gives me access_token but not refresh_token.

If I use "https" instead of "http" I receive this error:

error=invalid_scope&error_description=the requested scope is not available

From the documentation, I read that:

"The refresh token for the user-agent flow is only issued if you requested scope=refresh_token and one of the following scenarios is true:


  • The redirect URL host matches the request host and includes the servlet services/oauth2/success.

... "

I think to be in this case, what am I doing wrong?

I've also considered to use web-agent flow, but I guess that I can't provide connection to any user from any organization with that flow. Is it right?

Thanks in advance for any hints

  • 5
    Does this answer your question? Is OAuth 2.0 User-Agent Flow truly an Implicit Grant Type?
    – identigral
    May 13 at 16:09
  • 2
    Yes, you can - see the linked question shows. As the link tells you, user-agent is not recommended nowadays. The correct approach is authorization code flow (aka Web Server flow in SF) with PKCE extension.
    – identigral
    May 13 at 16:11
  • 1
    Thank you for your answers, can I authenticate users from other organizations with web server flow? In the doc I see that you must make request to your organization endpoint help.salesforce.com/s/… I need that any users can auth in his organization using my app
    – mmadd990
    May 15 at 6:58

1 Answer 1


Ok I did it using web-server flow with login.salesforce.com as host instead of my organization URL.

With User-agent flow I could obtain the token but using this redirect_url:


but then I was inside Salesforce success page and I couldn't do anything with the token info.

I fought that I was in this situation: "https://site_url/services/oauth2/success"

That is allowed by the documentation, but probably site_url is not the URL from where I make the request but is something related to Salesforce sites.

Thank you for your help!

Not the answer you're looking for? Browse other questions tagged or ask your own question.