I am writing an extension for an email client that will integrate emails and contacts from Salesforce.

It looks like the correct way to do the oauth thing will be using the User-Agent Flow method.

Is this the best way?

How do you handle the redirect_uri in a desktop app?

Is there any open-source example of the procedure using eg. WebKit?

Does the Token Refresh action require a browser window/user intervention again or does it happen behind the scenes?

Why is the client_secret optional for Token Refresh? What would adding it achieve?


For a desktop or other native application, the redirect URI is usually handled within some kind of browser component in the native language. The redirect URI can, at that point, be something "fake" (I like to call it a "fauxtocal"). So the flow would go:

  1. Send browser to login.salesforce.com with your app credentials
  2. After user confirmation, app sends user to your URI
  3. Depending on the language, detect either the URI itself - or sometimes you need to detect an error scenario since the page will be "not found"
  4. Parse access token from URI, close browser component.

Token refresh can be done behind the scenes with just the access token. I don't have an answer on why client secret is sometimes optional - but I would say if you don't need to send it, don't send it.

  • Is there any example somewhere for this @joshbirk if so can you please share that link?
    – Sathya
    Jan 17 '13 at 19:53
  • Is there a particular language you're looking for? I have a fairly complete iOS example here: github.com/joshbirk/iOSMobileNative
    – joshbirk
    Jan 18 '13 at 1:18
  • 3
    Mobile apps can't keep secrets, so the user-agent flow doesn't use client secret, and user-agents don't specify the client secret when refreshing tokens.
    – metadaddy
    Jan 23 '13 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.