---
schema_version: "1"
id: a6bc5329b360ab8fefb5c20337efd9ccdffdb9c51752b05242c3b3c94e7b586b
title: Handling Expired Access Tokens
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-sdk/latest/oauth-token-expiration.md
canonical_url: https://docs.mulesoft.com/mule-sdk/latest/oauth-token-expiration
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 36126f3d60061155359f107b399b49bbeb6fa67ecf7ad9bdd245f9e845cef40f
description: MuleSoft Documentation Site
release: "1.13"
latest: true
---
---
product: Mule SDK
version: 1.13
is-latest-version: true
keywords: mule, sdk, security, oauth
---

# Handling Expired Access Tokens

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Most services providers return (or should return) access tokens with a limited lifespan. In general,
access tokens usually expire about 30 to 60 minutes after being issued, although this is not a
standard that strictly enforced by providers.

In the same way, providers often provide a refresh token with the access token. The refresh token is
a second token that can be used to replace an expired access token with a fresh one, without the
need to perform the dance again.

Unfortunately, there is no enforced standard that the SDK can use to automatically detect a token
expiration scenario and obtain a new one. Different APIs communicate that in different ways. That is
why the `AccessTokenExpiredException` exception exists.

```java
public void someOperation(@Connection SalesforceRestClient client) { (1)
    Response response = client.performSomeOperation(); (2)
    if (response.getStatusCode() == 401) { (3)
        throw new AccessTokenExpiredException(); (4)
    }
}
```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>The example above uses an imaginary REST client to perform an operation. It assumes that this rest client was created through a <code>ConnectionProvider</code> annotated with <code>@AuthorizationCode</code>.</td></tr><tr><td><i data-value="2"></i><b>2</b></td><td>It performs the operation and gets a <code>Response</code> object that contains information of the HTTP call.</td></tr><tr><td><i data-value="3"></i><b>3</b></td><td>The example assumes that a status code of 401 (<code>unauthorize</code>) means that the token has expired.</td></tr><tr><td><i data-value="4"></i><b>4</b></td><td>It throws the <code>AccessTokenExpiredException</code>.</td></tr></tbody></table>

When the SDK detects this exception, it automatically performs the refresh dance and retries the
operation with a new access token.

Note that in real life, different APIs notify you of the access token expiration in different ways.
Some give you clients that throw exceptions, while others give you custom messages. You need to
research the remote API to determine the best way to account for this.