# OAuth tokens: refresh, expiration, revocation and introspection

*Platform Identity and Access Management Architect Study Guide · Salesforce as an Identity Provider · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/salesforce-as-an-identity-provider/oauth-tokens-refresh-expiration-revocation-and-introspection*

How long each OAuth token lives in Salesforce, how refresh token policies, the idle TTL limit, rotation and the refresh-flow secret behave, how to revoke tokens from the app, from Setup or by rotating consumer details, and how to validate ID tokens, opaque tokens and JWT-based access tokens.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Salesforce as an Identity Provider
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Describe the various implementation concepts of OAuth (scopes, secrets, tokens, refresh tokens, token expiration, token revocation, etc.).

## What the exam expects

- Describe each OAuth token (authorization code, access, refresh, ID) and what sets its lifetime.
- Choose a refresh token policy, and predict its effect on active sessions and under the idle TTL limit.
- Harden refresh tokens with rotation and Require Secret for Refresh Token Flow, and know when not to require the secret.
- Revoke tokens from a client app, from Setup, by blocking an app, or by rotating consumer details, and predict what each revokes.
- Validate tokens: ID token signatures, the introspection endpoint, and JWT-based versus opaque access tokens.
- Key terms: **refresh token** (long-lived token that gets new access tokens); **session timeout** (the connected app value that ends an access token); **revocation endpoint** (/services/oauth2/revoke); **introspection** (asking Salesforce for a token's current state); **JWT-based access token** (a signed token services validate locally).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Authorization code | Expires after 15 minutes | [Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5) |
| Access token lifetime | Connected app timeout, else profile, else org Session Settings | [Session Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&language=en_US&type=5) |
| Refresh token policy default | Refresh token is valid until revoked | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| Policy timing | Evaluated only when the refresh token is used | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| Idle TTL limit | 30-day sliding window; metadata not auto-updated | [Idle Refresh Token TTL](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_limit_idle_ttl.htm&language=en_US&type=5) |
| Require Secret for Refresh Token Flow | Auto-selected for new apps; not for pre-Spring '21 apps | [Enable OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&language=en_US&type=5) |
| Revoking a refresh token | Also revokes its associated access tokens | [Revoke OAuth Tokens](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_revoke_token.htm&language=en_US&type=5) |
| Applying new consumer details | Revokes all tokens; up to 10 minutes of intermittent behavior | [Rotate Consumer Details](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_rotate_consumer_details.htm&language=en_US&type=5) |
| ID token validity | 1-720 minutes, default 2 | [Enable OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&language=en_US&type=5) |
| Introspection endpoint | /services/oauth2/introspect; own tokens unless Introspect all tokens | [Token Introspection](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_token_introspection_endpoint.htm&language=en_US&type=5) |

## Check yourself

- Why does a 1-hour "Expire refresh token after" policy not interrupt a 4-hour session?
- When does applying new consumer details revoke tokens?
- How does an API gateway check opaque tokens issued through other apps?
- What sets an access token's lifetime for one app without changing the org?

## Sources

- [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5)
- [OAuth 2.0 Refresh Token Flow for Renewed Sessions](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_refresh_token_flow.htm&language=en_US&type=5)
- [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5)
- [Manage Session Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&language=en_US&type=5)
- [Limit the Idle Refresh Token TTL in Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_limit_idle_ttl.htm&language=en_US&type=5)
- [Enable OAuth Settings for API Integration](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&language=en_US&type=5)
- [OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5)
- [Revoke OAuth Tokens Programmatically](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_revoke_token.htm&language=en_US&type=5)
- [Manage Current OAuth Connected App Sessions](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_current_sessions.htm&language=en_US&type=5)
- [View and Rotate the Consumer Key and Consumer Secret of a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_rotate_consumer_details.htm&language=en_US&type=5)
- [Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_access_tokens.htm&language=en_US&type=5)
- [JWT-Based Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.jwt_access_tokens.htm&language=en_US&type=5)
- [OpenID Connect Token Introspection](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_token_introspection_endpoint.htm&language=en_US&type=5)
- [Configure a Connected App to Issue JWT-Based Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.jwt_connectedapp_enable.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 14 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams