4

I have a canvas a app that I distribute via a managed package on the AppExchange. The canvas app is configured to post a signed request to my heroku app. I have selected all the oauth scope options:

enter image description here

The issue I am having is when the post is made to my heroku app, there is no sign of a refresh_token in the JSON context.

**Update

Here is a screen from the canvas developer docs, showing that there is a refreshToken included in the POST JSON:

enter image description here

1

In Winter 17 I found that you need to add permission:

“Perform requests on your behalf at any time refreshToken (refresh_token, offline_access)”

https://resources.docs.salesforce.com/sfdc/pdf/canvas_framework.pdf

After I added it it returns refresh_token

2

To be clear, the docs you are referring to are the Summer '14 Docs. Summer '14 is not yet released. The current Spring '14 docs are at - http://www.salesforce.com/us/developer/docs/platform_connect/canvas_framework.pdf

In the summer release, you will see the refresh token if that scope has been requested, and you can also use refreshSignedRequest (which will not be available in Spring '14).

Also, refresh token is NOT supplied through canvas in Spring '14 regardless of the access method selected

  • The latest docs state that signed request Canvas requests don't carry the refresh token. I'm also not seeing it if i use oAuth HTTP GET approach. Any thoughts? – Andrew Fawcett Sep 29 '14 at 12:54
1

You can use refreshSignedRequest. Note that the refresh token isn't available for signed requests:

Signed Request (POST): OAuth authentication is used, but when the administrator installs the canvas app, they implicitly allow access for users. Therefore, the user won’t be prompted to allow the third-party to access their user information. When you use this access method, the authentication is posted directly to the canvas app URL. If your canvas app uses signed request authentication, then be sure you don’t add Perform requests on your behalf at any time to the Selected OAuth Scopes. Signed request authorization never returns a refresh token, even if this field value is selected.

* Emphasis mine

  • Thanks @sfdcfox, in the canvas developer docs you can do a quick search for "refreshToken", I have updated the question with a screen from the POST JSON section - salesforce.com/us/developer/docs/platform_connectpre/… – rumdumdum Jun 2 '14 at 20:35
  • @Rich I found what I was looking for. See my edit. – sfdcfox Jun 2 '14 at 20:42
  • @sfdcfox is correct, nor would you want an app to have unlimited access to open a new session when you're not consuming the canvas. – greenstork Jun 2 '14 at 20:45
  • thanks for the input guys, agree on with your view. Not sure why they have included the parameter in the docs. – rumdumdum Jun 2 '14 at 21:24
  • @Rich Because you can use three different flows: signed request, web-server oauth, and user-client oauth; the latter two do support refresh tokens. – sfdcfox Jun 2 '14 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.