Here is a web application which is integrated with salesforce. The integration part is:

  • After user completed a contact form and submitted, our logic will deal with it firstly, then pick out some items to synch to salesforce record.

To use restapi call, we need to get the access token from salesforce firstly.

Since above process is completely done in background, we don't want user to be redirected to salesforce login page.

Comparing to different Oauth flows, we chose "username-password oauth authentication flow", that is: getting access token by using our system account + password.

Now I have 2 questions:

1. Whether it is a good choice? If not, what is the better solution?

The precondition is: we shouldn't require the user has to be a salesforce user and we shouldn't redirect them to salesforce login page.

2. How can we judge whether the access token is expired? Is there any existing health call for the access token?

By "username-password" flow, we can only get access token, no refresh token.

I don't know how to judge the access token is expired or not, except encountering a "Session expired or invalid" error.

  • when we try to get an access token, why can't add the expiration time in the response body?
    – Phoenix
    Jun 3, 2015 at 20:22

1 Answer 1


Using the OAuth username and password authentication flow is viable for this sort of server to server interaction where you aren't actually working with credentials for the active user.

You will need a secure method of storing the credentials on your server. This will most likely include the security token, unless you have a static IP that can be setup as trusted in Salesforce.

There is no specific mechanism to detect an expired session other than the resulting errors. See (API) Automatically detect expired sessionId?

The common approach is to detect the expired session error and then reestablish the session using the stored credentials as required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.