How to get access token for my integrated application?

Question

Scenario:

Here is a web application which is integrated with salesforce. The integration part is:

• After user completed a contact form and submitted, our logic will deal with it firstly, then pick out some items to synch to salesforce record.

To use restapi call, we need to get the access token from salesforce firstly.

Since above process is completely done in background, we don't want user to be redirected to salesforce login page.

Comparing to different Oauth flows, we chose "username-password oauth authentication flow", that is: getting access token by using our system account + password.

Now I have 2 questions:

1. Whether it is a good choice? If not, what is the better solution?

The precondition is: we shouldn't require the user has to be a salesforce user and we shouldn't redirect them to salesforce login page.

2. How can we judge whether the access token is expired? Is there any existing health call for the access token?

By "username-password" flow, we can only get access token, no refresh token.

I don't know how to judge the access token is expired or not, except encountering a "Session expired or invalid" error.

Answer 1

Using the OAuth username and password authentication flow is viable for this sort of server to server interaction where you aren't actually working with credentials for the active user.

You will need a secure method of storing the credentials on your server. This will most likely include the security token, unless you have a static IP that can be setup as trusted in Salesforce.

---

There is no specific mechanism to detect an expired session other than the resulting errors. See (API) Automatically detect expired sessionId?

The common approach is to detect the expired session error and then reestablish the session using the stored credentials as required.