I am implementing Headless login with https://help.salesforce.com/s/articleView?language=en_US&id=sf.remoteaccess_authcodecreds_singlepageapp.htm&type=5
I have a case where the users password has expired but the token endpoint is returning me a access token that is perfectly valid and can be used in APIs (both standard and custom APIs). There are no errors either in the authorize or token endpoint call.
We have in the community profile that the password expires in 180 days but it seems the Headless oAuth API does not respect this. Is this a bug or is this how it should work ?
@Jani Ruohomaa in headless scenarios sf doesn't enforce password expiration at the time of token issuance, as this flow is meant to support automation and non-interactive logins. If you need more stringent control over expired passwords, you'll need to build additional safeguards or monitoring processes on top of the OAuth flow
