For improved security, Salesforce requires a 30-day limit to the idle refresh token TTL (time-to-live). The idle TTL is the amount of time that an OAuth refresh token can be inactive before it expires. When a refresh token expires, the user or app must request a new access token. The idle TTL works as a sliding window: each time the token is used within the 30 day-period, its idle TTL resets. For flows that don't use refresh tokens, this control also caps the access token lifetime at 30 days from the last login date.
Required Editions
| Available in: both Salesforce Classic and Lightning Experience |
|
Connected apps can be created in: Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer Editions Connected apps can be installed in: all editions |
| User Permissions Needed | |
|---|---|
| To read, create, update, or delete connected apps: | Customize Application AND either Modify All Data OR Manage Connected Apps |
How this Security Control Affects Your Apps
Here's what happens to your OAuth integrations when this control is turned on:
- Immediate expiration of all existing refresh tokens that have remained unused for 30 days or longer and all existing access where the last login date was more than 30 days ago.
- Ongoing enforcement of the new control. After enforcement, unused refresh tokens expire when they hit 30 days of inactivity. Long-running access tokens expire 30 days after their last login date.
This control also affects these refresh token policies:
- Refresh token is valid until revoked
- Expire refresh token after number unit of time
- Expire refresh token if not used for number unit of time
Work with your subscribers to let them know when you’re enabling these changes.
Enable the Idle Refresh Token TTL Control
Salesforce enforces this control for connected apps. Before enforcement, here's how to turn it on. If it's already enforced, you can't edit this setting.
- From Setup, in the Quick Find box, enter App and then click App Manager.
- Find your app and click Edit.
- In the API (Enable OAuth Settings) section, turn on Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days.
- Save your change.
Fix Inconsistencies with Refresh Token Policies
When this control is enforced, it affects refresh token policies for you and your subscribers. This change can introduce inconsistencies between the behavior, UI, and metadata. Here's how to update your apps to fix these inconsistencies:
| Refresh Token Policy | Behavior Changes with Idle TTL Limit | How to Fix Inconsistencies with UI, Behavior, and Metadata |
|---|---|---|
| Refresh token is valid until revoked | This policy is no longer valid with the idle TTL limit enforced. In the UI, this option becomes hidden and the policy selection changes to “Expire refresh token if not used for specific time” with the validity period set to 30 days. | Salesforce doesn’t automatically update the app’s metadata to reflect this change. To
update the ConnectedAppOauthPolicy metadata type: Change the
value of the refreshTokenPolicy field to
specific_inactivity:30:DAYS
|
| Immediately expire refresh token | None. This policy behaves the same way it did before. | Not applicable |
| Expire refresh token after number unit of time |
Refresh tokens still use the validity period configured in the app policies. If it’s longer than 30 days, the idle TTL limit also applies. For example, if the configured validity period is 1 year, idle tokens still expire after 30 days. With continuous use, tokens can last up to 1 year. |
Not applicable |
| Expire refresh token if not used for number unit of time | This validity period configured in this policy already works as an idle TTL with a sliding window. The only change is that the configured validity period can’t be longer than 30 days. |
Salesforce doesn’t automatically update the UI or metadata to reflect this change.
|