Database.com Chatter REST API Developer's Guide - Salesforce.com

Introducing Chatter REST API
Using Tokens
2. After successfully logging in, the user is asked to authorize the application. Note that if the user has already authorized the
application, this step is skipped.
3. Once Database.com has confirmed that the client application is authorized, the end-user’s Web browser is redirected to
the callback URL specified by the redirect_uri parameter, appended with the following values after the hash sign (#).
This is not a query string.
Parameters
access_token
expires_in
refresh_token
Description
Session ID that you can use for making Chatter API
requests. This session ID cannot be used in the user interface.
Treat this like a user's session and diligently protect it.
Amount of time the access token is valid, in seconds.
Token that can be used in the future to obtain new access
tokens (sessions).
Warning: This value is a secret. You should treat
it like the user's password and use appropriate
measures to protect it.
The refresh token is only returned if the redirect URI is
https://login.instance_name/services/oauth2/success
or used with a custom protocol that is not HTTPS.
The following additional parameters are returned; however, they aren't used with this flow and Chatter API:
• instance_url
• id
• signature
• issued_at
4. If the client application is a Web app, the redirection Web page that it uses may include JavaScript that the client application
can manipulate in order to retrieve the access and refresh tokens.
Alternatively, a client application (native or web) may use the page
https://login.instance_name/services/oauth2/success as their callback URL. Instead of actually loading
the page on redirect, they should intercept the redirection URI and extract the parameters values. Note that the
refresh_token parameter values are only provided if the redirection URI is this URI or if the redirection URI uses a
custom protocol.
Once the client application has retrieved the access and refresh tokens, it can use them to make requests to Chatter API.
Using Tokens
As part of both authentication flows, you will be working with access tokens and refresh tokens.
Using Access Tokens
To make a successful Chatter API request, you must include a valid access token in the request. This can be done by using
the HTTP Authorization header:
Authorization: OAuth
21