Salesforce: Refresh Tokens Expire After 30 Days of Inactivity

Overview

Salesforce is starting to enforce a 30-day limit on the lifetime of idle OAuth refresh tokens. A Salesforce connection that uses AuthScheme=OAuthPKCE or AuthScheme=OAuth and goes unused for 30 days must be re-authenticated.

The limit applies to all OAuth connected apps, including both the CData built-in OAuth application and custom connected applications. Each time a refresh token is used, its 30-day period resets.

When Salesforce turns this control on for an organization, it also revokes all existing access tokens once. CData products obtain a new access token automatically from the stored refresh token, so connections that are in regular use keep working.

Note: Salesforce is rolling this change out gradually and does not announce the exact date for each org. See the Salesforce announcement: Security Change: Refresh Token Idle TTL Is Limited to 30 Days.

Who Is Affected

What to Expect

No product updates are necessary. Audit your Salesforce connections to confirm which authentication scheme each one uses, then follow the guidance for how often the connection is used.

• Used at least once every 30 days: no action is needed. Your access token is revoked once, the connector automatically retrieves a new access token, and a new 30-day refresh token is issued.
• Used less than once every 30 days: switch to an authentication scheme that does not rely on refresh tokens.
• Failing with invalid_grant: expired access/refresh token: the refresh token has expired, so re-authenticate the connection.

For background on the OAuthPKCE scheme, see Salesforce: Migrating to OAuthPKCE Authentication.

Important Dates

The change is introduced as a rolling update, starting on these dates:

Support

Contact the CData Support Team if you have questions or need assistance.

• CData Software Support