Apex Reference Guide
jNewer Version Available
AuthToken Class
Namespace
Usage
To authenticate users via an authentication provider, you must create a class that implements the Auth.RegistrationHandler interface. When a user logs in to Salesforce via a provider such as Facebook, they’re issued an access token and in some cases, a refresh token. To retrieve and revoke these tokens, use the methods in the Auth.AuthToken class.
AuthToken Methods
The following are methods for AuthToken. All methods are static.
getAccessToken(authProviderId, providerName)
Signature
public static String getAccessToken(String authProviderId, String providerName)
Parameters
- authProviderId
- Type: String
- providerName
- Type: String
-
The proper name of the provider. Here are valid values for each
provider type.
- Apple—Apple
- Custom—For a custom authentication provider, use the value in the FriendlyName field on the AuthProvider object, such as MyProvider.
- Facebook—Facebook
- GitHub—GitHub
- Google—Google
- Janrain—Use the proper name of the third party, such as Yahoo!.
- LinkedIn—LinkedIn
- Microsoft—Microsoft
- Microsoft Access Control Service—Microsoft Access Control Service
- MuleSoft—MuleSoft
- Open ID Connect—Open ID Connect
- Salesforce—Salesforce
- Slack—Slack
- Twitter—This method doesn’t support the Twitter authentication provider.
Return Value
Type: String
getAccessTokenMap(authProviderId, providerName)
Signature
public static Map<String, String> getAccessTokenMap(String authProviderId, String providerName)
Parameters
- authProviderId
- Type: String
- providerName
- Type: String
- The proper name of the provider. Here are valid values for each provider type.
- Apple—Apple
- Custom—For a custom authentication provider, use the value in the FriendlyName field on the AuthProvider object, such as MyProvider.
- Facebook—Facebook
- GitHub—GitHub
- Google—Google
- Janrain—Use the proper name of the third party, such as Yahoo!.
- LinkedIn—LinkedIn
- Microsoft—Microsoft
- Microsoft Access Control Service—Microsoft Access Control Service
- MuleSoft—MuleSoft
- Open ID Connect—Open ID Connect
- Salesforce—Salesforce
- Slack—Slack
- Twitter—This method doesn’t support the Twitter authentication provider.
refreshAccessToken(authProviderId, providerName, oldAccessToken)
Signature
public static Map<String, String> refreshAccessToken(String authProviderId, String providerName, String oldAccessToken)
Parameters
- authProviderId
- Type: String
- providerName
- Type: String
- The proper name of the third party. Here are valid values for each provider type.
- Apple—Apple
- Custom—For a custom authentication provider, use the value in the FriendlyName field on the AuthProvider object, such as MyProvider.
- Facebook—Facebook
- GitHub—GitHub
- Google—Google
- Janrain—Use the proper name of the third party, such as Yahoo!.
- LinkedIn—LinkedIn
- Microsoft—Microsoft
- Microsoft Access Control Service—Microsoft Access Control Service
- MuleSoft—MuleSoft
- Open ID Connect—Open ID Connect
- Salesforce—Salesforce
- Slack—Slack
- Twitter—This method doesn’t support the Twitter authentication provider.
- oldAccessToken
- Type: String
Usage
The returned map contains AccessToken and RefreshError keys. Evaluate the keys in the response to check if the request was successful. For a successful request, the RefreshError value is null, and AccessToken is a token value. For an unsuccessful request, the RefreshError value is an error message, and the AccessToken value is null.
When successful, this method updates the token stored in the database, which you can get using Auth.AuthToken.getAccessToken().
If you’re using an OpenID Connect authentication provider, an id_token isn’t required in the response from the provider. If a Token Issuer is specified in the Auth. Provider settings and an id_token is provided anyway, Salesforce verifies it.
Example
1String accessToken = Auth.AuthToken.getAccessToken('0SOD000000000DeOAI', 'Open ID Connect');
2Map<String, String> responseMap = Auth.AuthToken.refreshAccessToken('0SOD000000000DeOAI', 'Open ID Connect', accessToken);A successful request includes the access token in the response.
1 (RefreshError,null)(AccessToken,00DD00000007BhE!AQkAQFzj...)revokeAccess(authProviderId, providerName, userId, remoteIdentifier)
Signature
public static Boolean revokeAccess(String authProviderId, String providerName, String userId, String remoteIdentifier)
Parameters
- authProviderId
- Type: String
- The ID of the authentication provider in Salesforce.
- providerName
- Type: String
- The name of the third party. Here are valid providerName values
for each provider type.
- Apple—apple
- Custom—For a custom authentication provider, use a lowercase version of the value in the FriendlyName field on the AuthProvider object. For example, if the FriendlyName is MyProvider, use myprovider.
- Facebook—facebook
- GitHub—github
- Google—google
- Janrain—Use a lowercase version of the name of the third party, such as yahoo!.
- LinkedIn—linkedin
- Microsoft—microsoft
- Microsoft Access Control Service—microsoft access control service
- MuleSoft—mulesoft
- Open ID Connect—open id connect
- Salesforce—salesforce
- Slack—slack
- Twitter—twitter
- userId
- Type: String
- The 15-character ID for the user whose access is being revoked.
- remoteIdentifier
- Type: String
- The unique ID for the user in the third-party system (this value is in the associated ThirdPartyAccountLink standard object).
Return Value
Type: Boolean
The return value is true if the revokeAccess() operation is successful; otherwise false.
Example
The following example revokes a Facebook user's access token.
1Auth.AuthToken.revokeAccess('0SOxx00000#####', 'facebook', '005xx00000#####', 'ThirdPartyIdentifier_exist214176560#####');