AuthToken Class

Contains methods for getting and revoking access and refresh tokens that are issued when a user logs in via a single sign-on (SSO) flow that uses an authentication provider, such as Facebook.

Auth

To authenticate users via an authentication provider, you must create a class that implements the Auth.RegistrationHandler interface. When a user logs in to Salesforce via a provider such as Facebook, they’re issued an access token and in some cases, a refresh token. To retrieve and revoke these tokens, use the methods in the Auth.AuthToken class.

The following are methods for AuthToken. All methods are static.

Returns an access token for the current user using the specified 18-character identifier of an AuthProvider definition in your org and the proper name of the provider, such as Salesforce or Facebook.

public static String getAccessToken(String authProviderId, String providerName)

  • authProviderId:

    Type: String

  • providerName:

    Type: String

    The proper name of the provider. Here are valid values for each provider type.

    • Apple—Apple
    • Custom—For a custom authentication provider, use the value in the FriendlyName field on the AuthProvider object, such as MyProvider.
    • Facebook—Facebook
    • GitHub—GitHub
    • Google—Google
    • Janrain—Use the proper name of the third party, such as Yahoo!.
    • LinkedIn—LinkedIn
    • Microsoft—Microsoft
    • Microsoft Access Control Service—Microsoft Access Control Service
    • MuleSoft—MuleSoft
    • Open ID Connect—Open ID Connect
    • Salesforce—Salesforce
    • Slack—Slack
    • Twitter—This method doesn’t support the Twitter authentication provider.

    The providerName value that you pass into this method can be different from the value that’s returned if you query the ProviderType field on the AuthProvider object. For example, for Open ID Connect providers, OpenIdConnect is the ProviderType value for the AuthProvider object, but the expected providerName is Open ID Connect.

Type: String

Returns a map from the provider’s identifier to the access token for the currently logged-in Salesforce user. The identifier value depends on the provider. For example, for Salesforce, it’s the user ID, while for Facebook, it’s the user number.

public static Map<String, String> getAccessTokenMap(String authProviderId, String providerName)

  • authProviderId:

    Type: String

  • providerName:

    Type: String

    The proper name of the provider. Here are valid values for each provider type.

    • Apple—Apple
    • Custom—For a custom authentication provider, use the value in the FriendlyName field on the AuthProvider object, such as MyProvider.
    • Facebook—Facebook
    • GitHub—GitHub
    • Google—Google
    • Janrain—Use the proper name of the third party, such as Yahoo!.
    • LinkedIn—LinkedIn
    • Microsoft—Microsoft
    • Microsoft Access Control Service—Microsoft Access Control Service
    • MuleSoft—MuleSoft
    • Open ID Connect—Open ID Connect
    • Salesforce—Salesforce
    • Slack—Slack
    • Twitter—This method doesn’t support the Twitter authentication provider.

    The providerName value that you pass into this method can be different from the value that’s returned if you query the ProviderType field on the AuthProvider object. For example, for Open ID Connect providers, OpenIdConnect is the ProviderType value for the AuthProvider object, but the expected providerName is Open ID Connect.

Type: Map<String, String>

Returns a map from the third-party provider’s identifier containing a refreshed access token for the currently logged-in Salesforce user.

public static Map<String, String> refreshAccessToken(String authProviderId, String providerName, String oldAccessToken)

  • authProviderId:

    Type: String

  • providerName:

    Type: String

    The proper name of the third party. Here are valid values for each provider type.

    • Apple—Apple
    • Custom—For a custom authentication provider, use the value in the FriendlyName field on the AuthProvider object, such as MyProvider.
    • Facebook—Facebook
    • GitHub—GitHub
    • Google—Google
    • Janrain—Use the proper name of the third party, such as Yahoo!.
    • LinkedIn—LinkedIn
    • Microsoft—Microsoft
    • Microsoft Access Control Service—Microsoft Access Control Service
    • MuleSoft—MuleSoft
    • Open ID Connect—Open ID Connect
    • Salesforce—Salesforce
    • Slack—Slack
    • Twitter—This method doesn’t support the Twitter authentication provider.

    The providerName value that you pass into this method can be different from the value that’s returned if you query the ProviderType field on the AuthProvider object. For example, for Open ID Connect providers, OpenIdConnect is the ProviderType value for the AuthProvider object, but the expected providerName is Open ID Connect.

  • oldAccessToken:

    Type: String

Type: Map<String, String>

The returned map contains AccessToken and RefreshError keys. Evaluate the keys in the response to check if the request was successful. For a successful request, the RefreshError value is null, and AccessToken is a token value. For an unsuccessful request, the RefreshError value is an error message, and the AccessToken value is null.

When successful, this method updates the token stored in the database, which you can get using Auth.AuthToken.getAccessToken().

If you’re using an OpenID Connect authentication provider, an id_token isn’t required in the response from the provider. If a Token Issuer is specified in the Auth. Provider settings and an id_token is provided anyway, Salesforce verifies it.

A successful request includes the access token in the response.

Revokes the access token for a specified SSO user from a provider such as Facebook. You can use this method only if the IsNotSsoUsable field on the associated ThirdPartyAccountLink object is set to false.

public static Boolean revokeAccess(String authProviderId, String providerName, String userId, String remoteIdentifier)

  • authProviderId:

    Type: String

    The ID of the authentication provider in Salesforce.

  • providerName:

    Type: String

    The name of the third party. Here are valid providerName values for each provider type.

    The providerName value that you pass into this method must be lowercase.
    • Apple—apple
    • Custom—For a custom authentication provider, use a lowercase version of the value in the FriendlyName field on the AuthProvider object. For example, if the FriendlyName is MyProvider, use myprovider.
    • Facebook—facebook
    • GitHub—github
    • Google—google
    • Janrain—Use a lowercase version of the name of the third party, such as yahoo!.
    • LinkedIn—linkedin
    • Microsoft—microsoft
    • Microsoft Access Control Service—microsoft access control service
    • MuleSoft—mulesoft
    • Open ID Connect—open id connect
    • Salesforce—salesforce
    • Slack—slack
    • Twitter—twitter

    The providerName that you pass into this method is different from the value that you get if you query the ProviderType field on the AuthProvider object. For example, for Open ID Connect providers, the providerType value for the AuthProvider object is OpenIdConnect, but the providerName for the revokeAccess method is open id connect.

  • userId:

    Type: String

    The 15-character ID for the user whose access is being revoked.

  • remoteIdentifier:

    Type: String

    The unique ID for the user in the third-party system (this value is in the associated ThirdPartyAccountLink standard object).

Type: Boolean

The return value is true if the revokeAccess() operation is successful; otherwise false.

The following example revokes a Facebook user’s access token.