Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
9 votes
Accepted

Why does my salesforce access token expire after a certain time?

Salesforce Access Tokens/Session IDs expire only during periods of inactivity. The window is automatically refreshed for a token if it is used at least 50% of the way through its expiration. For ...
sfdcfox's user avatar
  • 494k
5 votes

Refresh Token in Connected App (change password)

Changing your username, password, or security token (or even all of them) will not revoke a Refresh Token. A token expires when (a) the session is specifically revoked (e.g. in Setup > Session ...
sfdcfox's user avatar
  • 494k
4 votes
Accepted

Allow Session ID to persist after release

I would recommend using the JWT flow for this use case, not the username-password flow. There is a nice guide to doing headless JWT authentication in the Salesforce DX Developer Guide. You don't have ...
David Reed's user avatar
  • 93.1k
4 votes

Oauth- getting refresh token

You posted in your code that you are setting the value of refresh_token to refresh_token. It needs to be the refresh token you got in the access token response (5Aep861HDR3iASSX_protected_JIgHyRWn....
Eric's user avatar
  • 54.2k
4 votes
Accepted

Understanding the refresh token workflow

There's a number of things you need to do to get everything just right. Under Setup > Create > Apps, go down to your connected app, and verify it has the "refresh_token" scope enabled. Next, check ...
sfdcfox's user avatar
  • 494k
4 votes
Accepted

How to get Refresh Token in Postman in 2024?

Only certain flows provide you with a refresh token, and the Client Credentials flow is not one of them. The User-Agent flow (a.k.a. the "implicit" flow/grant type) can return a refresh ...
Derek F's user avatar
  • 62k
3 votes

How to Make Session Expire with Salesforce Connected App Web Server Flow

Session Timeout Org defaults is overrrided by Profile's Session Timeout Value. Make sure that's also 15 mins. You can control session settings on a user profile basis. If you don’t configure the ...
Pranay Jaiswal's user avatar
3 votes
Accepted

How to get Salesforce Security token without refreshing it

You can't retrieve a security token or password for any user from Salesforce, as a matter of security. You'll have to reset it, or get it from somewhere else. Note that even salesforce.com technical ...
sfdcfox's user avatar
  • 494k
2 votes

How do I refresh an ExactTarget token using the REST API?

Checkout "accessType": "offline" when request for access token. It will give you a refresh access token to use when the "main" access token has expire, this refresh token is valid up to 700 days and ...
tkhuynh's user avatar
  • 211
2 votes

Distributed same copy of access_token and refresh_token, will it be problem to refresh the token in different process?

Based on empirical observation, using the same refresh_token to repeatedly request an access_token yields exactly the same result. I tested establishing a session from only the known refresh_token ...
Daniel Ballinger's user avatar
2 votes

Oauth- getting refresh token

In case someone else stumbles upon this in the future - I was having a problem due to a setting in the Manage Apps > Connected Apps > Manage > Edit Policies. Under oAuth settings, there is an option ...
karan's user avatar
  • 170
2 votes
Accepted

Can't get refresh_token in callback with a 'full' scope

Specify both scopes: scope: "refresh_token full", The scope parameter is a space-delimited list of scopes you would like to request. You can specify as many scopes as you need to be as granular as ...
sfdcfox's user avatar
  • 494k
2 votes
Accepted

Named Credential: Authentication process and refresh token

Currently, Named Credential refreshes access token only if Refresh token was provided otherwise not. Recently, I got stuck with same issue while developing integration with Instagram and I had to opt ...
Ayub's user avatar
  • 3,523
2 votes

Refresh Token using Salesforce Named Credentials and Auth Provider

In the Named Credential you should set Scope to refresh_token.
Robert Sösemann's user avatar
2 votes

Refresh Token using Salesforce Named Credentials and Auth Provider

I believe (based on a discussion with a client who uses WSO2) that the default config for WSO2 generates Refresh Tokens which expire after 24 hours. So long as you make an API call after the Access ...
Jason Clark's user avatar
  • 11.9k
2 votes

invalid_grant: expired access/refresh token with refresh token included in JSForce

You don't need to create a new connection on a refresh. This will cause problems. You can use the handler to store the access token, but you should not be forcing a new connection.
sfdcfox's user avatar
  • 494k
2 votes
Accepted

Connected App for API & Canvas App Settings seem to contradict each other

First, I am assuming that your scenarios (1) and (2) are really one and the same. The external website calling into Salesforce is wholly represented by your Canvas-based app. That is, all API calls (...
identigral's user avatar
  • 7,625
2 votes
Accepted

How to Make Session Expire with Salesforce Connected App Web Server Flow

I was finally able to get it working (meaning, timeout expiring after 15 minutes). The Salesforce page is quite busy and using both the "Quick Find" and navigating without it sometimes produces ...
Kris's user avatar
  • 305
2 votes
Accepted

scratch org connection vs oAuth access token

The SFDX plugin uses an OAuth flow that includes a scope of "refresh_token". This scope allows the client to request a new access token whenever it expires, as long as the refresh token is ...
sfdcfox's user avatar
  • 494k
2 votes

Users need to reauthenticate Per User Oauth2 Integration

Without looking into their Oauth 2.0 implementation it is hard to tell if this is a problem in the API implementation. Also, it is important to understand what is the duration of refresh token. If the ...
Mohith Shrivastava's user avatar
1 vote
Accepted

Error: `the requested scope is not available` with scope=full+refresh_token in User Agent OAuth Flow

To get a refresh token, you need to use the Web Server flow for your web app. This uses the grant type of "authorization_code" instead of "token." This is the appropriate flow to use for web apps. ...
sfdcfox's user avatar
  • 494k
1 vote

Is there a way to get new access token when current session get expired without using Connected App?

Now, I want to remove dependency of Connected App because of some reasons. So I want to know is there any way to get new access token without using Connected App? No. You will always need to provide ...
Jayant Das's user avatar
  • 30.6k
1 vote

Refresh Token using Salesforce Named Credentials and Auth Provider

In my case i had use Scope as refresh_token full If we just use refresh_token then the endpoint will not allow us to call API Note that the order of scope is also important.
AtulRajguru9's user avatar
  • 9,120
1 vote
Accepted

Seamless Sign On - Single Sign On

You may need to go to My Domain and make sure the only authentication method checked is your Single Sign On configuration, and that login is unchecked. This will force Salesforce to try ...
IllusiveBrian's user avatar
1 vote

Seamless Sign On - Single Sign On

That's a feature of the IdP, not Salesforce. You will need to configure the IdP to control how sessions are authenticated. For example, in our org, the IdP will reauthenticate automatically within ...
sfdcfox's user avatar
  • 494k
1 vote

Named Credential: Authentication process and refresh token

just add to scope (in named credentials and/or auth provider): refresh_token full
Jacek Strzalkowski's user avatar
1 vote
Accepted

OAuth 2.0 JWT Bearer Token Flow refresh_token

Nope, not quite. The need to use the refresh token flow is a one-time thing. After the user has authorized the connected app once, you can then make JWT Bearer requests for that connected app forever (...
Derek F's user avatar
  • 62k
1 vote

Getting OAuth 2.0 Refresh Token returns invalid_client_id

The client_id and the client_secret parameters should be in the body of the request. The only parameter supported in the header is the format you'd like the response to be returned in. From the ...
Mark Pond's user avatar
  • 23k
1 vote

Getting OAuth 2.0 Refresh Token returns invalid_client_id

grant_type,client_id,client_secret and refresh_token should be in BODY instead of Request header. SRC:https://help.salesforce.com/articleView?id=remoteaccess_oauth_refresh_token_flow.htm&type=5 ...
Pranay Jaiswal's user avatar
1 vote
Accepted

REST API access and refresh token workflow question

Refresh tokens have a different policy than access tokens, which are basically session IDs. Access tokens follow the rules for session IDs, meaning they can last up to 24 hours without usage. ...
sfdcfox's user avatar
  • 494k

Only top scored, non community-wiki answers of a minimum length are eligible