Here is a web application which is integrated with salesforce. The integration part is:
- After user completed a contact form and submitted, our logic will deal with it firstly, then pick out some items to synch to salesforce record.
To use restapi call, we need to get the access token from salesforce firstly.
Since above process is completely done in background, we don't want user to be redirected to salesforce login page.
Comparing to different Oauth flows, we chose "username-password oauth authentication flow", that is: getting access token by using our system account + password.
Now I have 2 questions:
1. Whether it is a good choice? If not, what is the better solution?
The precondition is: we shouldn't require the user has to be a salesforce user and we shouldn't redirect them to salesforce login page.
2. How can we judge whether the access token is expired? Is there any existing health call for the access token?
By "username-password" flow, we can only get access token, no refresh token.
I don't know how to judge the access token is expired or not, except encountering a "Session expired or invalid" error.