I am working with force.com REST API using PhoneGap, JQuery mobile By using REST-API tool kit if found it in Github. I am using ChildBrowser for authentication.

What i am doing is first i am logging in with ChildBrowser and getting access_token, refresh_token saving these values as cookies. If we open the next time app will use access_token until it expires. When it expires i am trying to refresh the token using

forcetk.js --> refreshAccessToken method by setting the refresh_token which was saved as a cookie.

But it is throwing an exception:

{error: "Invalid_grant","error_description":"expired access/refresh token"}

I don't want to use child browser to login every time when open the mobile application. It should be first time only after words i am trying to refresh the token and use it.

  • 1
    Cookies don't work like this in PhoneGap (google phonegap cookie to find out more). If you can't use the Mobile SDK, as Gaurav suggests, you should store the refresh token in the iOS keychain or the equivalent on your platform.
    – metadaddy
    Commented Dec 26, 2012 at 15:58
  • Cookies actually working fine. I could able to store and alert all those cookie values, which are access_token, refresh_token.
    – Ayyappak
    Commented Jan 3, 2013 at 10:27
  • Interesting. I guess it might be an encoding issue - does the refresh token have any special characters in it? I know access token has a '!'.
    – metadaddy
    Commented Jan 4, 2013 at 1:32
  • To add to what Patt mentioned, you might want to look at this thread which is about the same error scenario albeit for a web application - boards.developerforce.com/t5/General-Development/… Commented Jan 4, 2013 at 10:05

1 Answer 1


If you want to use jQuery Mobile as the front end for your application, you should consider using the force.com Mobile SDK hybrid template (for Android or iOS - depending on which OS you are building for).

The hybrid template automatically manages the oAuth handshake as well as validity/expiry of your access and refresh tokens.

Is there a specific reason why you're NOT using the Mobile SDK hybrid template for this?

  • I want to support it for Blackberry also and i want it to be a generic app. There is no hybird SKD for blackberry. I could able to store refresh token as a cookie.
    – Ayyappak
    Commented Jan 3, 2013 at 10:25
  • I see. That's a valid use case for NOT using the Mobile SDK Commented Jan 4, 2013 at 9:54
  • For local development, we use a plugin for the MockCordova library from the Mobile SDK to handle OAuth. It pulls the tokens out of location hash after authenticating, stores them in localStorage, and then refreshes automatically when you call subsequently call getAuthCredentials. Could work for you. Code's a little rough, but you can check it out: bit.ly/1biCYfH
    – xn.
    Commented Nov 25, 2013 at 20:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .