4

I have a canvas a app that I distribute via a managed package on the AppExchange. The canvas app is configured to post a signed request to my heroku app. I have selected all the oauth scope options:

enter image description here

The issue I am having is when the post is made to my heroku app, there is no sign of a refresh_token in the JSON context.

**Update

Here is a screen from the canvas developer docs, showing that there is a refreshToken included in the POST JSON:

enter image description here

Improve this question

3 Answers 3

Reset to default
1

In Winter 17 I found that you need to add permission:

“Perform requests on your behalf at any time refreshToken (refresh_token, offline_access)”

https://resources.docs.salesforce.com/sfdc/pdf/canvas_framework.pdf

After I added it it returns refresh_token

Improve this answer
2

To be clear, the docs you are referring to are the Summer '14 Docs. Summer '14 is not yet released. The current Spring '14 docs are at - http://www.salesforce.com/us/developer/docs/platform_connect/canvas_framework.pdf

In the summer release, you will see the refresh token if that scope has been requested, and you can also use refreshSignedRequest (which will not be available in Spring '14).

Also, refresh token is NOT supplied through canvas in Spring '14 regardless of the access method selected

Improve this answer
1
  • The latest docs state that signed request Canvas requests don't carry the refresh token. I'm also not seeing it if i use oAuth HTTP GET approach. Any thoughts?
    – Andrew Fawcett
    Sep 29, 2014 at 12:54
1

You can use refreshSignedRequest. Note that the refresh token isn't available for signed requests:

Signed Request (POST): OAuth authentication is used, but when the administrator installs the canvas app, they implicitly allow access for users. Therefore, the user won’t be prompted to allow the third-party to access their user information. When you use this access method, the authentication is posted directly to the canvas app URL. If your canvas app uses signed request authentication, then be sure you don’t add Perform requests on your behalf at any time to the Selected OAuth Scopes. Signed request authorization never returns a refresh token, even if this field value is selected.

* Emphasis mine

Improve this answer
7
  • Thanks @sfdcfox, in the canvas developer docs you can do a quick search for "refreshToken", I have updated the question with a screen from the POST JSON section - salesforce.com/us/developer/docs/platform_connectpre/…
    – rumdumdum
    Jun 2, 2014 at 20:35
  • @Rich I found what I was looking for. See my edit.
    – sfdcfox
    Jun 2, 2014 at 20:42
  • @sfdcfox is correct, nor would you want an app to have unlimited access to open a new session when you're not consuming the canvas.
    – greenstork
    Jun 2, 2014 at 20:45
  • thanks for the input guys, agree on with your view. Not sure why they have included the parameter in the docs.
    – rumdumdum
    Jun 2, 2014 at 21:24
  • @Rich Because you can use three different flows: signed request, web-server oauth, and user-client oauth; the latter two do support refresh tokens.
    – sfdcfox
    Jun 2, 2014 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .