To ensure the highest level of trust and security for Customer Data, Salesforce is further strengthening security controls. We’ve added two additional mandatory OAuth security requirements for Connected App (CA) and External Client App (ECA) solutions. These mandatory requirements must be implemented by partners by May 2026.
Where: Additional mandatory OAuth security requirements apply to any Connected App or External Client App (ECA) that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs.
When: OAuth security requirements must be implemented for any CAs/ECAs by May 11, 2026.
Why: Additional mandatory OAuth security requirements consist of the following:
- Refresh Token IP Range Allow list: Restrict OAuth refresh tokens to known network locations by defining allowed IP ranges.
- Idle Refresh Token Time-to-Live (TTL): Sets a 30-day limit to the idle refresh token TTL, which is the amount of time a refresh token can be idle before it expires.
How: In your ECA or Connected App settings:
- Turn on Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days. In the app’s policies page, the Refresh Token Policy heading indicates that the idle TTL limit is enforced.
- Define allowed IP ranges and turn on Enforce Refresh Token IP Allowlist. The system then automatically validates the request IP against these stored ranges during the token exchange process.
- Self-attest. After all changes are implemented, partners must self-attest that the app is onboarded to these security controls and all relevant client changes are complete. After the attestation is made, the security controls are locked and can’t be disabled. ISVs are allowed to update the IP ranges in the Connected App or ECA configuration if needed. To self-attest and lock the security controls, click Review Controls at the top of the Connected App or ECA setup page. The Review Controls box is only available when at least one of the security controls is turned on.