---
schema_version: "1"
id: 873956a34573243d3594048c5d866149150dfd8c117e90a3bbe404922c2eb043
title: OAuth Pairing for Mobile Applications
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mobile_security_oauth.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mobile_security_oauth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a20ccd15991c74c117b2c1503db0b204916b982ce0241f96076e94e9a65a5d64
description: Salesforce uses OAuth2.0 for mobile application authentication through username and password or SSO (single sign-on) credentials.
products:
  - Security
  - Mobile App
  - Cross Cloud
release: "264"
---
# OAuth Pairing for Mobile Applications

Salesforce uses OAuth2.0 for mobile application authentication through username and password or SSO (single sign-on) credentials.

During the initial login, the device is uniquely identified and paired with the mobile user’s account using the OAuth 2.0 protocol ([http://tools.ietf.org/html/rfc6749](http://tools.ietf.org/html/rfc6749)). All requests to the Salesforce service are made using the OAuth token established through the pairing created during activation.

After initial login, there’s no exchange of a password in the communication between the mobile client and the Salesforce server. For this reason, the Salesforce password isn’t stored on the device and isn’t required even when the password is changed or has expired.

A user obtains an access token and refresh token after successfully completing the OAuth User-Agent authentication. A user can use the refresh token to get a new access token (session ID). Upon logout, the OAuth access and refresh tokens are revoked, and the user set passcode is wiped (if org admin enables passcode protection). The user is reprompted to enter the username and password and reset the passcode.

The available refresh token expiration policies:

- Refresh token never expires.
- Refresh token expires immediately (for example, the refresh token is never valid).
- Refresh token expires if it isn’t used for an amount of defined time (hours or days or months).
- Refresh token expires in a defined amount of time (hours or days or months), regardless of use.

The default access token expiration schedule is set at 2 hours, but can be as short as 15 minutes or as long as 24 hours

## Access Token Storage

- Salesforce Mobile App for iOS: The encryption standard is AES with 256-bit key and 128-bit Initialization Vector. The encryption keys are a secure random-generated 256-bit key and 128-bit Initialization Vector. The access token is stored in a secured keychain.
- Salesforce Mobile App for Android: PBKDF2 produced AES-256 encrypted key derived from a device unique Android ID and randomly generated string. Token is stored in Android’s encrypted AccountManager.

## Refresh Token Storage

- Salesforce Mobile App for iOS: The encryption standard is AES with a 256-bit key and 128-bit Initialization Vector. The encryption keys are a secure random-generated 256-bit key and 128-bit Initialization Vector. The refresh token is stored in a secured keychain.
- Salesforce Mobile App for Android: PBKDF2 produced AES-256 encrypted key derived from a device unique Android ID and randomly generated string. The token is stored in Android’s encrypted AccountManager.