Salesforce is one of the most popular customer relationship management (CRM) platforms available for businesses of all sizes and industries, and it offers robust security measures. It uses OAuth 2.0, a means of digital third-party authorization, to provide quick access to resources and login information for the users of connected apps — all via a tool known as an access token.
However, these tokens sometimes expire after a certain amount of time, for security reasons. When a Salesforce access token expires, users must find a way to renew or refresh the token to maintain access to that application. Let’s explore what makes Salesforce access tokens work in the first place and how to handle their expiration.
How access tokens in Salesforce work
An access token in Salesforce is a digital value that represents a session ID for a user. When a user inputs a token to access an app that’s connected to Salesforce, the token acts as a replacement for typical Salesforce credentials to authenticate the user’s information.
The OAuth 2.0 authorization framework is the industry standard for a third-party authorization protocol. In use for over a decade, this standard ensures developers of apps connected to platforms like Salesforce can allow their users to share information about their accounts with third-party applications connected to those platforms.
The access token is essentially the currency of OAuth 2.0, enabling authorized and secure connections between apps to safely transfer sensitive information. In this case, Salesforce hosts the resources on a secure resource server, and the token acts as a key that connects the two.
Imagine these access tokens that OAuth 2.0 generates as digital versions of real-life game tokens: They act as one-off, secure, and non-counterfeitable virtual objects that allow the individuals using them to access a Salesforce-connected app, like Jotform for Salesforce.
What to do when a Salesforce access token expires
In order to maintain security for both the user and the app, Salesforce tokens have a limited lifespan. If a user waits too long to apply the token — typically more than two hours — the Salesforce access token will expire, forcing them to refresh the token or acquire a new one altogether.
Refresh tokens are directly granted by OAuth-enabled connected apps, according to their unique policies. They can automatically grant refresh tokens for certain users based on previous logins, provide time-stamped windows for using these tokens, or use other factors to grant access.
On the Salesforce help page, information directs the user to do the following:
- Check if refresh tokens are provided
- Continue to access any OAuth-enabled connected applications —no need to reauthorize when the original access token expires
- The app directly exchanges the original access token for a refresh token to start a new session.
Whenever someone uses an issued token, they only have to request a refresh token if they’ve ended their session. The window of time when the token is available doesn’t affect the length of a user session. For example, if a user is on the app for two hours, but you’ve set a refresh token policy to expire the token after one hour, they won’t have to reauthenticate after one hour.
For users of Salesforce-connected apps, reaching out about a refresh token requires what’s known as an “API call.” This is a message sent to a server requesting services, information, or, in this case, access (or renewed access) to elements of the API. Be sure to use the refresh token as quickly as possible to avoid being locked out of your apps for even longer.
How to access tokens work with Jotform for Salesforce
Like any Salesforce-connected app, Jotform for Salesforce uses access tokens to quickly validate Salesforce users on our platform in just a few steps.
- Go to the Home page. Under Platform Tools, select Apps.
- From the dropdown menu under Connected Apps, choose Connected Apps OAuth Usage.
- If it’s not already installed, click Install.
- Locate the app you want to modify and click the Manage App Policies link next to it. Then, click the Edit Policies button to proceed.
- You’ll now see the current refresh token policies for the app.
- Scroll down to OAuth Policies, where you can adjust token policies. However, proceed with caution — altering these settings could cause permission problems.
Consult our guide to understand more about refresh tokens in Salesforce.
With thousands of apps on its AppExchange marketplace, Salesforce provides access to a variety of third-party capabilities to enhance the user experience. By understanding the use of access and refresh tokens, and by ensuring your safe transfer of login credentials when using these apps, your Salesforce experience can be a seamless, secure process.
Photo by ANTONI SHKRABA production
Send Comment: