Salesforce OAuth Refresh Token Rotation

Grace Wannapongsai
Grace Wannapongsai
  • Updated

Who is this for?

Riva Cloud customers

  • Refresh Token Rotation (RTR) is required by Salesforce for AppExchange applications.
  • Riva Cloud supports RTR automatically. Customers running a supported version of Riva do not need to perform any additional configuration.

On-premises customers

  • RTR is optional but supported for customers who want to enable Salesforce Refresh Token Rotation for additional security.
  • Follow the steps below to configure RTR.

 

Why enable RTR?

Refresh Token Rotation improves security by replacing the refresh token after each successful authentication. If a refresh token is compromised, it can no longer be reused after it has been rotated.

 

Prerequisites

  • Riva Sync 2026.2-net48 or later
  • Riva Sync 2026.3 (net8) or later
  • Access to the Salesforce Connected App
  • Access to the Riva application configuration files

 

Configure Salesforce

  1. Open the Salesforce Connected App.
  2. Navigate to the OAuth configuration.
  3. Enable Refresh Token Rotation.
  4. Save the Connected App.

 

Configure Riva

Add the following setting to:

  • RAS app configuration
  • Sync node app configuration
  • On-premises application configuration
Sync.Crm.RefreshTokenRotationManagementEnabled=true

 

Restart or Reauthorization

No restart or reauthorization is normally required.

If you receive an invalid_grant exception, revalidate the Salesforce connection to obtain a new refresh token.

 

Verify the Configuration

RTR is working correctly if:

  • Synchronization continues normally.
  • No invalid_session errors occur.
  • No invalid_grant errors occur.