29

I ran across this problem myself and have only just found the solution; I couldn't find it documented anywhere. The short answer is, your app needs permissions (scope) to have the ability to use refresh tokens. In Setup > Create > Apps, click the "Edit" link for your Connected App and add the scope "Perform requests on your behalf at any time (...


26

I see you've discovered most of this for yourself, but I had this drafted, so I thought I'd post it also, in case it fills in any gaps. From the docs on connected apps: An application may be listed more than once. Each time you grant access to an application, it obtains a new access token. Requests for refresh tokens increase the Use Count displayed ...


17

https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_request_manage.htm An application may be listed more than once. Each time you grant access to an application, it obtains a new access token. Requests for refresh tokens increase the Use Count displayed for the application. You must grant access to your Salesforce data from each device that you ...


7

Yes, Communities users can use OAuth 2.0. Instead of login.salesforce.com, Use the Community URL as the prefix to the authorization URL - for example, https://acme.force.com/customers/services/oauth2/authorize. See the section Configuring Authentication Flows with OAuth in Getting Started With Communities. Yes, the Community login page can be branded. See ...


5

The refresh token may have an indefinite lifetime, persisting for an admin-configured interval or until explicitly revoked by the end-user. Since refresh tokens may expire or be revoked by the user outside the control of the client application, the client must handle failure to obtain an access token, typically by replaying the protocol from the start. In ...


4

You posted in your code that you are setting the value of refresh_token to refresh_token. It needs to be the refresh token you got in the access token response (5Aep861HDR3iASSX_protected_JIgHyRWn.6oH6XKva0f76V5AxRE7YhZygZQg). not sure if you replaced the actual refresh token with the words "refresh_token" but since you had no problem posting it later in ...


4

I would recommend using the JWT flow for this use case, not the username-password flow. There is a nice guide to doing headless JWT authentication in the Salesforce DX Developer Guide. You don't have to use SFDX to do this; there are JWT libraries available for many languages. The benefit of using JWT is that your application can always obtain a new token (...


3

I got the Answer. I just changed the callback url in connected app settings to my app url and we have to use http instead of https.


2

To be clear, the docs you are referring to are the Summer '14 Docs. Summer '14 is not yet released. The current Spring '14 docs are at - http://www.salesforce.com/us/developer/docs/platform_connect/canvas_framework.pdf In the summer release, you will see the refresh token if that scope has been requested, and you can also use refreshSignedRequest (which ...


2

Checkout "accessType": "offline" when request for access token. It will give you a refresh access token to use when the "main" access token has expire, this refresh token is valid up to 700 days and has a 5-minute revocation period after use. You will have an extra window of 5 min to continue making requests when the "main" token expire. Hope this helps: MC ...


2

Based on empirical observation, using the same refresh_token to repeatedly request an access_token yields exactly the same result. I tested establishing a session from only the known refresh_token several times over the course of 5 minutes. In all cases I got the same session ID back. This is consistent with how the login() method works in the Partner API. ...


2

In case someone else stumbles upon this in the future - I was having a problem due to a setting in the Manage Apps > Connected Apps > Manage > Edit Policies. Under oAuth settings, there is an option called "Refresh Token Policy". Mine was set to expire immediately by default for the app I am developing. Please change it to Refresh token is valid until ...


2

Specify both scopes: scope: "refresh_token full", The scope parameter is a space-delimited list of scopes you would like to request. You can specify as many scopes as you need to be as granular as you'd like. The parameter needs to be encoded using the method outlined in this help topic.


2

The long story Let's trace what's going on. There's basically 3 layers in a hybrid app: Your code The Salesforce Cordova Javascript Interface *1 The Salesforce Cordova Plugin (native, for either iOS or Android) *2 *3 First, your code calls cordova.require("salesforce/plugin/oauth").getAuthCredentials(...,...); That ends up in layer 2, the Salesforce ...


2

Currently, Named Credential refreshes access token only if Refresh token was provided otherwise not. Recently, I got stuck with same issue while developing integration with Instagram and I had to opt the custom solution by using custom setting and Visualforce page. Actually, Salesforce is following a standard option to refresh the token, they can not ...


2

There's a number of things you need to do to get everything just right. Under Setup > Create > Apps, go down to your connected app, and verify it has the "refresh_token" scope enabled. Next, check Setup > Manage Apps > Connected Apps OAuth Usage and make sure your app is not Blocked. After that, go to Setup > Manage Apps > Connected Apps, and make sure the ...


2

First, I am assuming that your scenarios (1) and (2) are really one and the same. The external website calling into Salesforce is wholly represented by your Canvas-based app. That is, all API calls (incl. authentication / authorization) from your external website go through Canvas SDK. If this assumption is NOT true, you should create two connected apps - ...


2

You don't need to create a new connection on a refresh. This will cause problems. You can use the handler to store the access token, but you should not be forcing a new connection.


2

Without looking into their Oauth 2.0 implementation it is hard to tell if this is a problem in the API implementation. Also, it is important to understand what is the duration of refresh token. If the refresh token expiration is set to 7 days only then it is not good to use of refresh token. The refresh token should have an expiration of 1 year at least. For ...


2

The SFDX plugin uses an OAuth flow that includes a scope of "refresh_token". This scope allows the client to request a new access token whenever it expires, as long as the refresh token is still valid. You can read more about this flow in the OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration and OAuth 2.0 Refresh Token Flow for ...


1

grant_type,client_id,client_secret and refresh_token should be in BODY instead of Request header. SRC:https://help.salesforce.com/articleView?id=remoteaccess_oauth_refresh_token_flow.htm&type=5 https://salesforce.stackexchange.com/a/148016/19118


1

Refresh tokens have a different policy than access tokens, which are basically session IDs. Access tokens follow the rules for session IDs, meaning they can last up to 24 hours without usage. Conversely, refresh tokens can last indefinitely if configured to do so, and if permitted by the Connected App settings. Assuming you set your refresh token to last ...


1

The refresh token is "permanent", meaning it lasts until it is revoked or manually logged out. You do not need to get a new refresh token every time you get a new access token. You can use the refresh token to get as many new access tokens as you'd like. Note that the system prefers to return an existing, non-expired access as opposed to a new one when you ...


1

This has always been the best guide to oAuth for me: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com Re refresh tokens, see this section: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com#Token_Refresh But yes, it depends on the type of flow you are using, and how the Connected App is ...


1

After speaking with someone at Salesforce they have confirmed that the refresh token is a one time use refresh token. So to reduce code complexity I guess I will just have to drop the whole refresh token bit and just request an access token every time the access token expires. I do not see the point in a one time refresh token.


1

The redirect_uri is the Callback URL that you define in your Connected App. See the documentation for Setting up OAuth 2.0 for more information.


1

I'd expect all API based logins to go via login.salesforce.com. From Authenticating Apps with OAuth. The three primary endpoints used with OAuth 2.0 are: Authorization—https://login.salesforce.com/services/oauth2/authorize Token—https://login.salesforce.com/services/oauth2/token Revoke—https://login.salesforce.com/services/oauth2/revoke ...


1

Sorry for the late response, but I came across your question when looking for something else. Hopefully you found what you need, but just in case, here's two concepts that we use: Use a user script in the browser to refresh the view every few minutes - we use Chrome as the browser and the Tampermonkey plugin to load the user script Create a button in ...


1

Depending on the use case, if you have an application and if you have the ability to store the timestamp of your last API callout, then you can check the time difference between now and your last call against the session expiry time in SF. If the time difference < session expiry time, use access token followed by a refresh token if it fails. In case where ...


1

Generally I'd go with the second, there's no need to refresh if the current one works. Current code bases I have attempt to use the access token and if it fails then it grabs a new one via the refresh token. Just saves doing an extra request every single time and therefore has the potential to be a little quicker for the end user.


Only top voted, non community-wiki answers of a minimum length are eligible