3625833 - Frequently Asked Question of CSRF Token Usage in V2 system

Below are a few commonly asked questions and their answers regarding CSRF Token Usage for SAP Sales and Service Cloud V2.

• SAP Sales Cloud V2
• SAP Service Cloud V2

1. When making a call to /sap/c4c/api/v1/iam-service/token, the token received is valid for 1 hour. Is there a token refresh mechanism or is it always required a new token request?

There is a refresh mechanism that can be used to extend the token valid.

Refresh Token Generate Request For the First Time:

Method: POST 
URL: https://<domain_name>/auth/token

Request Headers:
Header Field     Description               Format
Authorization    Basic Authorization    Basic \

Request Body:
grant_type: refresh_token 

Note: Request Body is of type x-www-form-urlencoded

2. Is there a way to check the token validity? A new call to /sap/c4c/api/v1/iam-service/token simply returns a new token.

Yes, when requesting the token (or refresh it), the validity time will always appears like:

{ "value": { "access_token": "<access_token>"

"expires_in": 599 (in seconds)
} }

expires_in will inform the remaining time for token validity.

3. How to check the remaining validity of existing token at any time without refreshing it or requesting the new one? 

To check the validity use a decoder, e.g. jwt. io.
To do it, just copy the request token. The response will show the value "exp" that will show the expiration time (place the mouse above the information to see the time).

CSRF Token, Token Validity, Token Refresh, FAQ , KBA , CEC-CRM-IAM , Identity and Access Management for SAP Sales/Service Cloud , Problem

SAP Sales Cloud and SAP Service Cloud Version 2 all versions