I'm working on putting together a quick integration using OAuth, and stubbed out a POC in one Salesforce public Site that authenticates against another. Everything seems to work fine, except I don't get a refresh token back with my authorization. After looking through the documentation some more, it looks like you can only get a refresh token if you meet the following criteria:

How does this work for anyone that wants to redirect to a different domain using https? Would you need to manually force the user to reauthenticate via the dialog every time there is an expiration, or do you set up a non-secure endpoint for your redirect URI just to get refresh token?


2 Answers 2


The key to this depends on the flow you're using. The specific rules around redirect uris are specific to the User Agent flow. We won't hand out refresh tokens out to those urls if you're using that flow. If you use the webserver flow (response_type=code) and ask for the appropriate scopes, then things work better.

As far as your question about a non-secure endpoint, definetely not. The non-https schemes refer to custom schemes like myiphoneapp://callback

  • This doesn't really answer the question of why the refresh token isn't returned to non-Salesforce callback URLs. Why trust the host to extract the access token from the URL fragment, but not the refresh token?
    – xn.
    Dec 6, 2013 at 22:16

I think the answer to my issue of getting a refresh_token from a web application was a culmination of a couple different things:

  • Needing to enable "Perform requests on your behalf at any time" as a selected OAuth scope for the App
  • Needing to explicitly request the refresh_token in the scope (although it says the default returns it, I noticed that is not the case)
  • So I've enabled all of this and I still don't get a refresh token returned. Anything else I should check? Jul 14, 2014 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.