Timeout on OAuth2 access tokens

Question

I'm creating a service that uses OAuth2 to get an access token and refresh token from Salesforce. I want to avoid making a request with an expired access token, so I want to be able to predict when the access token will expire and request a new one if necessary before making a request.

I've noticed that the authentication response doesn't include "expires_in," which is listed as "recommended" in the OAuth2 spec. It does include "issued_at", but there isn't an obvious way to tell how long after that the token will expire.

In Setup->Security Controls->Session Settings, there is a dropdown for "Timeout value," ranging from 15 minutes to 12 hours. This Stack Overflow (http://stackoverflow.com/a/9261825) answer says Timeout value is used for OAuth2 access token expiration, but I can't find this in any official documentation. Is this correct, and is there anywhere in the Salesforce docs that lists this information? Thanks!

Davis Goodin · Accepted Answer

I found the answer in this doc  ( http://www.salesforce.com/us/developer/docs/api_rest/Content/intro_understanding_refresh_token_oauth.htm )just after asking. Sure enough, "The session timeout for an access token can be configured in Salesforce from Setup by clicking Security Controls | Session Settings."

Timeout on OAuth2 access tokens

Security

Risorse di formazione correlate

Ulteriore assistenza