IntegrationIntermediateoauthrefresh-tokensecurity
Implement OAuth refresh token rotation for long-running Salesforce integrations
Real World Scenario
Integration refresh tokens never rotated; leaked token from 2019 backup grants API access until discovered in audit.
Expected Answer
• Refresh token rotation: each refresh returns new refresh token invalidate old
• Secure token storage vault encrypted at rest
• Monitor refresh failures alerting credential revocation
• Prefer JWT bearer eliminating refresh token attack surface
• Connected app refresh token policy expire if unused 90 days
• Separate tokens per environment never share prod refresh in dev
• Incident response revoke all connected app tokens procedure
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Refresh token rotation: each refresh returns new refresh token invalidate old Also consider: Secure token storage vault encrypted at rest In practice: Monitor refresh failures alerting credential revocation Balance speed of delivery with maintainability.
Architect Perspective
Long-lived refresh tokens are credentials—rotation policy or migrate to JWT.