Expired access or refresh token error in Salesforce

Support DQE

Updated 05 November 2026 18:07

DQE One connects to your Salesforce org through a dedicated authorization (the DQE One Installer connected app, called External Client App in newer Salesforce orgs) created during installation. Every time a process is launched — a scheduled job, a manual merge, a data stewardship action, or a mapping run — DQE One uses a refresh token stored in its configuration to request a short-lived access token before calling out to the DQE service. If that refresh token is no longer valid, the process fails immediately with an "Expired access/refresh token" error, even though nothing in the process configuration itself has changed.

Common symptoms

a process that used to run successfully now fails as soon as it starts;
the error message contains "expired access/refresh token" or "invalid_grant";
the failure is not tied to a recent change in the process, mapping, or rule set;
scheduled jobs, manual merges, data stewardship actions, and real-time calls can all be affected, since they share the same connection;
the issue can reappear after some time even if it was previously fixed.

Why this happens

The refresh token used by DQE One is tied to the authorization granted to the DQE One Installer connected app during setup. Salesforce invalidates that refresh token independently of DQE One whenever one of the following occurs on the org side:

the connected app's OAuth policy enforces a refresh token lifetime (for example "expires after a defined period") and that period has elapsed;
the token was explicitly revoked — for example from Setup > Connected Apps OAuth Usage, or as part of a security review;
the Salesforce user who originally authorized the connection was deactivated, frozen, or had the API Enabled permission removed;
the connected app's OAuth policy rotates the refresh token on use (Rotate Refresh Token) — DQE One stores a single refresh token value and only updates it during installation/reinstallation, so if rotation is enabled on your org, the stored value can become stale between two installer runs.

In all these cases, reconnecting through the DQE One setup — as described below — issues a brand-new refresh token and resolves the error.

Resolution: reconnect DQE One

Go to the DQE One setup.
Uninstall the existing configuration.
Launch the installation again by clicking Start Installation.
- Fill in the license field.
- Fill in the backend URL only if you use your own, self-hosted DQE server — leave it empty otherwise.
- Select the products associated with your contract.
If the installation fails because of previous credentials, click Exit on the failure page (not Retry), so the previous credentials are uninstalled instead of reused.
Launch the installation again with the same fields (license, backend URL, products).
The installation should complete successfully.
If you use the real-time module, go to Named Credentials, edit the DQE One Tooling API named credential, then save it.

How to prevent this from happening again

In Salesforce Setup, open the DQE One Installer connected app / external client app and review its OAuth policies: check the refresh token policy (lifetime) and whether Rotate Refresh Token is enabled. If your org's security policy requires rotation, DQE One will need to be reconnected each time it takes effect.
Avoid deactivating, freezing, or removing the API Enabled permission from the user who authorized the DQE One connection without reconnecting DQE One under another user first.
Check Setup > Connected Apps OAuth Usage before revoking tokens for the DQE One Installer app, since this immediately breaks all DQE One processes.

When to contact DQE Support

If the error persists after reconnecting, provide the Salesforce environment, the organization ID, the process or job affected, the exact error message, the timestamp of the failure, and whether the issue is a one-time occurrence or recurring.

Related to

Was this article helpful?

0 out of 0 found this helpful