API for Validating OAuth Access Token

Question

Here is my usecase,

I have two apps, one written in rails and other is written in R. App written on rails acts as landing page. From there we can go in to app written in R.

We are using Salesforce OAuth to get authenticated for rails app. And we want to use the same access token in R apps as well.

Accesss token fetched in rails app can be passed to R app along with instance URL. Now in R app how can we make sure the Access token is valid? Is there any API which will check whether the accesstoken is valid or not?

If we have the API I can just make sure the access token is valid in R app.

Answer 1

I haven't seen such a thing, although even if it existed it would have been pointless to perform an additional round-trip to the server and introduce unnecessary delays when loading the app.

I would always go with the assumption that the token is still valid and hit my desired endpoint regardless. You should wrap this into a try/catch block and deal with the invalid token response accordingly.

Update:

As per your last comment, if your other app does not require to be connected to Salesforce, I suggest you to seek alternative validation rather than using the token. The token is only valid for a short period of time which will also invalidate the other app (unless that's your goal, then you could as I said reach out to any SF endpoint to validate the response).

Answer 2

If simple validation is enough in your case, you can use this..

You can decode the access token and can compare the expiration time with current timestamp. I think it is a simple Base64 encryption. If you decrypt the access token you will get the expiration time. Then check,

if(exp > currentTime)
{
   return "valid";
}else{
   return "invalid";
}