Here is my usecase,

I have two apps, one written in rails and other is written in R. App written on rails acts as landing page. From there we can go in to app written in R.

We are using Salesforce OAuth to get authenticated for rails app. And we want to use the same access token in R apps as well.

Accesss token fetched in rails app can be passed to R app along with instance URL. Now in R app how can we make sure the Access token is valid? Is there any API which will check whether the accesstoken is valid or not?

If we have the API I can just make sure the access token is valid in R app.

  • 1
    You can just hit up the endpoint assuming it's valid and then handle the non-valid response (obtain new access token using the refresh token etc.) Aug 24, 2015 at 5:29
  • Thats the approach I have to take, if we don't have any API to validate access token. Aug 24, 2015 at 5:31
  • I don't think such an endpoint exists, but even if it does, why would you do an additional round-trip to the server? Aug 24, 2015 at 5:35
  • My R app does not require to get any thing from salesforce. It just needs to be authenticated against salesforce. I such case, just verifying my accesstoken with API would be good. Else I would like to use some simple API's like get [userinfo] (developer.salesforce.com/docs/atlas.en-us.api.meta/api/…). Do we have eqivalent REST API? Aug 24, 2015 at 5:50
  • 1
    If your app does not require to get anything from Salesforce, what's the reason for the token? Here is the REST API doc and how to retrieve standard object data - developer.salesforce.com/docs/atlas.en-us.api_rest.meta/… Aug 24, 2015 at 5:54

2 Answers 2


I haven't seen such a thing, although even if it existed it would have been pointless to perform an additional round-trip to the server and introduce unnecessary delays when loading the app.

I would always go with the assumption that the token is still valid and hit my desired endpoint regardless. You should wrap this into a try/catch block and deal with the invalid token response accordingly.


As per your last comment, if your other app does not require to be connected to Salesforce, I suggest you to seek alternative validation rather than using the token. The token is only valid for a short period of time which will also invalidate the other app (unless that's your goal, then you could as I said reach out to any SF endpoint to validate the response).

  • I just want to have the token to be valid for short duration Aug 24, 2015 at 9:20

If simple validation is enough in your case, you can use this..

You can decode the access token and can compare the expiration time with current timestamp. I think it is a simple Base64 encryption. If you decrypt the access token you will get the expiration time. Then check,

if(exp > currentTime)
   return "valid";
   return "invalid";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.