Why is refresh_token only returned in particular cases using OAuth?

Question

I'm working on putting together a quick integration using OAuth, and stubbed out a POC in one Salesforce public Site that authenticates against another. Everything seems to work fine, except I don't get a refresh token back with my authorization. After looking through the documentation some more, it looks like you can only get a refresh token if you meet the following criteria:

• The redirect URI has a custom (non-https) scheme
• The redirect URL is exactly https://login.salesforce.com/services/oauth2/success, or on Force.com Sandbox, https://test.salesforce.com/services/oauth2/success.

How does this work for anyone that wants to redirect to a different domain using https? Would you need to manually force the user to reauthenticate via the dialog every time there is an expiration, or do you set up a non-secure endpoint for your redirect URI just to get refresh token?

Answer 1

The key to this depends on the flow you're using. The specific rules around redirect uris are specific to the User Agent flow. We won't hand out refresh tokens out to those urls if you're using that flow. If you use the webserver flow (response_type=code) and ask for the appropriate scopes, then things work better.

As far as your question about a non-secure endpoint, definetely not. The non-https schemes refer to custom schemes like myiphoneapp://callback

Answer 2

I think the answer to my issue of getting a refresh_token from a web application was a culmination of a couple different things:

• Needing to enable "Perform requests on your behalf at any time" as a selected OAuth scope for the App
• Needing to explicitly request the refresh_token in the scope (although it says the default returns it, I noticed that is not the case)