OAuth interactions: do they count as API calls?

Question

OAuth token grants and token authorizations are human interactions that take place in the browser. And token refreshes happen to be machine interactions. Do any of the typical OAuth interactions count towards the 24-hour API limit?

I know the following API invocations count toward the 24-hour limit:

Rest API
SOAP API

And the following do NOT count toward that 24-hour limit:

Apex Callouts
Outbound Messages

https://developer.salesforce.com/docs/atlas.en-us.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_platform_api.htm

I did find "What counts towards my API limit?". In terms of OAuth follows, I'm thinking that you need to have a Session Id for it to be counted, but this is just a guess. Maybe write a short section of code that tries to do 1000 token refreshes and see if you get a blip in the usage? — Daniel Ballinger, May 18 '16 at 20:56

score 12 · Accepted Answer · answered May 20 '16 at 11:02

12

After hammering the login.salesforce.com endpoints today (and getting blocked a couple of times), I've established (at least to my satisfaction) that the OAuth interactions around granting access tokens and refreshing them do not count against the API limits.

More specifically, I've hit the following endpoints 1,000 times each today.

https://login.salesforce.com/services/oauth2/authorize
https://login.salesforce.com/services/oauth2/token (both grant_type=password and grant_type=refresh_token)

... and the results.

Wait... that's not the result you want, this is.

PS. It's also worth noting that grants and token authorisation are not always human interactions, the Username-Password flow requires no user interaction.

answered May 20 '16 at 11:02

Alex Tennant

13,571
4
58
85

1

Superb investigation!! – Matt and Neil May 20 '16 at 23:25
+1 I salute you sir for your willingness to possibly lock yourself out of your org and Salesforce in general. – Daniel Ballinger May 25 '16 at 02:29
Cheers Alex, great hard evidence in this answer. – Simon Lawrence Jan 31 '18 at 11:12

score 0 · Answer 2 · answered Aug 22 '18 at 07:40

I would like to add that I performed a similar exercise as Alex Tennant did but instead called the https://login.salesforce.com/services/oauth2/userinfo endpoint which is part of the OpenID Connect protocol.

I called it thousands of times and can confirm that also for this endpoint no API Requests were used.

If you want to reproduce this scenario in your own org, you can use the following curl command in a terminal.

curl -X GET \
  'https://login.salesforce.com/services/oauth2/userinfo?[1-10000]=' \
  -H 'Authorization: Bearer <use_your_own_token_here>'

This will call the UserInfo endpoint 10000 times in a row.

OAuth interactions: do they count as API calls?

2 Answers2

Linked