Here is my usecase,

I have two apps, one written in rails and other is written in R. App written on rails acts as landing page. From there we can go in to app written in R.

We are using Salesforce OAuth to get authenticated for rails app. And we want to use the same access token in R apps as well.

Accesss token fetched in rails app can be passed to R app along with instance URL. Now in R app how can we make sure the Access token is valid? Is there any API which will check whether the accesstoken is valid or not?

If we have the API I can just make sure the access token is valid in R app.

  • 1
    You can just hit up the endpoint assuming it's valid and then handle the non-valid response (obtain new access token using the refresh token etc.) – Boris Bachovski Aug 24 '15 at 5:29
  • Thats the approach I have to take, if we don't have any API to validate access token. – Samuel Alexander Aug 24 '15 at 5:31
  • I don't think such an endpoint exists, but even if it does, why would you do an additional round-trip to the server? – Boris Bachovski Aug 24 '15 at 5:35
  • My R app does not require to get any thing from salesforce. It just needs to be authenticated against salesforce. I such case, just verifying my accesstoken with API would be good. Else I would like to use some simple API's like get [userinfo] (developer.salesforce.com/docs/atlas.en-us.api.meta/api/…). Do we have eqivalent REST API? – Samuel Alexander Aug 24 '15 at 5:50
  • 1
    If your app does not require to get anything from Salesforce, what's the reason for the token? Here is the REST API doc and how to retrieve standard object data - developer.salesforce.com/docs/atlas.en-us.api_rest.meta/… – Boris Bachovski Aug 24 '15 at 5:54

I haven't seen such a thing, although even if it existed it would have been pointless to perform an additional round-trip to the server and introduce unnecessary delays when loading the app.

I would always go with the assumption that the token is still valid and hit my desired endpoint regardless. You should wrap this into a try/catch block and deal with the invalid token response accordingly.


As per your last comment, if your other app does not require to be connected to Salesforce, I suggest you to seek alternative validation rather than using the token. The token is only valid for a short period of time which will also invalidate the other app (unless that's your goal, then you could as I said reach out to any SF endpoint to validate the response).

| improve this answer | |
  • I just want to have the token to be valid for short duration – Samuel Alexander Aug 24 '15 at 9:20

If simple validation is enough in your case, you can use this..

You can decode the access token and can compare the expiration time with current timestamp. I think it is a simple Base64 encryption. If you decrypt the access token you will get the expiration time. Then check,

if(exp > currentTime)
   return "valid";
   return "invalid";
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.