OAuth Refresh Token Issues with Concurrent Users in n8n (Salesforce Integration – 302 Responses)

Questions
1

Describe the problem/error/question

I’am currently facing an issue with Salesforce OAuth integration when using n8n to manage authentication and API calls, and would really appreciate your guidance.

bserved Behavior:

  • Able to list data and run SOQL queries using the same n8n credential without issues

  • However, when performing custom field updates, we receive HTTP 302 responses

  • The integration works perfectly for a single user/session

  • When multiple users authenticate concurrently, the issue starts appearing

  • The 302 response seems to indicate a redirect (possibly session/token invalidation)

    We are testing this setup using a single Salesforce org with two System Admin users (different login IDs/passwords).

    Our backend system dynamically creates n8n credentials per user, storing each user’s OAuth tokens. The corresponding n8n credential ID is stored in our backend database, and workflows are executed using that credential to perform actions on behalf of the authorized user.

Please share your workflow

Share the output returned by the last node

For same n8n credential id getting 302 response

Information on your n8n setup

  • n8n version: 1.105.3
  • Database (default: SQLite): no
  • n8n EXECUTIONS_PROCESS setting (default: own, main): default
  • Running n8n via (Docker, npm, n8n cloud, desktop app): Cloud
  • Operating system: Ubuntu 24 LTS
3

welcome to the n8n community @GAURAV_KUMAR2
I would verify that each concurrent user really uses a separate n8n credential record with its own refresh token and then enable automatic retries/re-auth on 302 responses, because Salesforce OAuth refresh flows can break when multiple sessions overwrite or reuse the same token state instead of staying isolated per user.

5

The 302s are almost certainly Salesforce invalidating tokens when multiple users hit the same Connected App simultaneously, each refresh overwrites the last one. You need separate Connected Apps per user (separate consumer key/secret pairs) so token refreshes dont stomp on each other and id also bump off 1.105.3 since theres a known OAuth code-verifier bug around concurrent auth