Hi David,

I haven't been working with this stuff for long, so I don't necessarily know the best way, but I've used your #3 - catch the error on using an expired token, and re-authenticate (see more below).

If you want to do #2, take a look at the response from my salesforce_login() function, you'll see $response["issued_at"], which is the number of milliseconds since the Unix Epoch (January 1 1970 00:00:00 GMT). You could save this (or, indeed, save the entire $response) and use it to check the age of the token on each call.

On #1 - I don't think there is a REST API endpoint to specfically verify the validity of a token. In any case, since the majority of calls will be made with a valid token, the most efficient approach is to just assume the token is valid and handle the error when it expires.

Here's my code to do exactly that:

// Wraps the actual GET - does the OAuth, and relogs in if necessary
function do_get($request) {
    // This is the response object that we retrieved from the session elsewhere
    global $response;

    // Do a maximum of two GETs
    for ($i = 0; $i < 2; $i++) {
        $access_token = $response["access_token"];
        $instance_url = $response["instance_url"];

        $curl = curl_init($instance_url.$request);
        curl_setopt($curl, CURLOPT_HEADER, false);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($curl, CURLOPT_HTTPHEADER,
                array("Authorization: OAuth $access_token"));

        $json_response = curl_exec($curl);
        $status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
        curl_close($curl);

        if ($status == 200) {
            return json_decode($json_response, true);
        } else if ($i == 0) {
            // Refresh the token for one more try...
            $response = salesforce_login(USERNAME, PASSWORD);

            $_SESSION["sflogin"] = $response;
        }
    }

    var_dump($json_response);
    die("Error: call to URL $url failed with status $status\n");
}

Cheers,

Pat