Question

In this page, it is mentioned refresh_token is returned only for callback URLs that do not start with HTTPS or point back to salesforce.

https://na5.salesforce.com/help/doc/en/remoteaccess_oauth_user_agent_flow.htm

However, in the SF->setup->develop->remote application creation page it takes only URL starting with HTTPS or an arbitrary string like abcd’.

Are there any tricks to get the refresh_token when the authorization URL ( i.e., OAuth authorization) is launched in a browser?

We want to use refresh_token to revalidate access_token ( when it expires) without having to prompt the login window.

Answer 1

We were using the wrong flow( user-agent flow). If we use WebServer flow we get refresh_token sent to https: urls as well.