+ Start a Discussion

Why has OAuth stopped returning refresh_token...?

Our REST API calls just suddenly stopped working since there is no way using the refresh_token procedure. We then found out there was actually no refresh_token provided after the user has been authenticated in the first place, even though this has always been the case previously.

We read a previous thread here about using that parameter scope=full, but whatever parameter we attach here there is always a HTTP Error 400 response. According to the documentation, if skipping the scope param it should default to ID + refresh_token + API. But when we skip it we only get this response: 










Why is this…?




In this situation, the client application can use the refresh token to obtain a new access token. The refresh token represents the user's access grant to the application, and is valid until explicitly revoked by the user, via Setup ? My Personal  Information ?  Remote  Access.


The client application obtains a new access token by Posting another request to https://login.salesforce.com/services/oauth2/token, this time with payload of the form:z


grant_type = Set this to refresh_token.

client_id = Your application's client identifier.

client_secret = Your application's client secret (optional).

refresh_token  = The refresh token provided in the previous access grant.


Did this answer your question? If not, let me know what didn't work, or if so, please mark it solved. 




Thanks, but I am afraid you misunderstood me..


We never GET a refresh_token at all anymore in the first authentication. But we did get it in the past and then there was never a problem to actually obtain a new access_token. But now suddenly we don't get it anymore.


It is a complete mystery. 



I found a solution:


The problem is that the scope=full parameter for some reason just stopped working i.e. the API-ignored it. Maybe a Salesforce representative could comment on this..?


Anyway, instead I explicitly specified scope= api id refresh_token (space between each param) which instantly solved my problem and the refresh_token was submitted accordingly.