Salesforce as an Identity Provider17% of the exam
OAuth tokens: refresh, expiration, revocation and introspection
How long each OAuth token lives in Salesforce, how refresh token policies, the idle TTL limit, rotation and the refresh-flow secret behave, how to revoke tokens from the app, from Setup or by rotating consumer details, and how to validate ID tokens, opaque tokens and JWT-based access tokens.
Describe the various implementation concepts of OAuth (scopes, secrets, tokens, refresh tokens, token expiration, token revocation, etc.).
~7 min read · 14 practice questions ·
What the exam expects
- Describe each OAuth token (authorization code, access, refresh, ID) and what sets its lifetime.
- Choose a refresh token policy, and predict its effect on active sessions and under the idle TTL limit.
- Harden refresh tokens with rotation and Require Secret for Refresh Token Flow, and know when not to require the secret.
- Revoke tokens from a client app, from Setup, by blocking an app, or by rotating consumer details, and predict what each revokes.
- Validate tokens: ID token signatures, the introspection endpoint, and JWT-based versus opaque access tokens.
- Key terms: refresh token (long-lived token that gets new access tokens); session timeout (the connected app value that ends an access token); revocation endpoint (/services/oauth2/revoke); introspection (asking Salesforce for a token's current state); JWT-based access token (a signed token services validate locally).
Key facts
Authorization code
- Detail
- Expires after 15 minutes
Access token lifetime
- Detail
- Connected app timeout, else profile, else org Session Settings
Refresh token policy default
- Detail
- Refresh token is valid until revoked
Policy timing
- Detail
- Evaluated only when the refresh token is used
Idle TTL limit
- Detail
- 30-day sliding window; metadata not auto-updated
Require Secret for Refresh Token Flow
- Detail
- Auto-selected for new apps; not for pre-Spring '21 apps
Revoking a refresh token
- Detail
- Also revokes its associated access tokens
Applying new consumer details
- Detail
- Revokes all tokens; up to 10 minutes of intermittent behavior
ID token validity
- Detail
- 1-720 minutes, default 2
Introspection endpoint
- Detail
- /services/oauth2/introspect; own tokens unless Introspect all tokens
Sources for this section (8)
- Web Server Flowhelp.salesforce.com (opens in a new tab)
- Session Policieshelp.salesforce.com (opens in a new tab)
- Manage OAuth Access Policieshelp.salesforce.com (opens in a new tab)
- Idle Refresh Token TTLhelp.salesforce.com (opens in a new tab)
- Enable OAuth Settingshelp.salesforce.com (opens in a new tab)
- Revoke OAuth Tokenshelp.salesforce.com (opens in a new tab)
- Rotate Consumer Detailshelp.salesforce.com (opens in a new tab)
- Token Introspectionhelp.salesforce.com (opens in a new tab)
- Why does a 1-hour "Expire refresh token after" policy not interrupt a 4-hour session?
- When does applying new consumer details revoke tokens?
- How does an API gateway check opaque tokens issued through other apps?
- What sets an access token's lifetime for one app without changing the org?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (14 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams