---
schema_version: "1"
id: b523b1d7b4e1e475ace6ca2b6bcd1438af1e7518b2effffdcd3596d27c750530
title: Review and Comply with Connected App and ECA Security Requirements
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_appexchange_ca_eca_additional.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_appexchange_ca_eca_additional.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 20b191e041acbd9c4d52407b2c52da92c80f217a96058492926ceacbf0f40dd8
description: To ensure the highest level of trust and security for Customer Data, Salesforce is further strengthening security controls. We’ve added two additional mandatory OAuth security requirements for Connected App (CA) and External Client App (ECA) solutions. These mandatory requirements must be implemented by partners by May 2026.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Review and Comply with Connected App and ECA Security Requirements

To ensure the highest level of trust and security for Customer Data, Salesforce is further strengthening security controls. We’ve added two additional mandatory OAuth security requirements for Connected App (CA) and External Client App (ECA) solutions. These mandatory requirements must be implemented by partners by May 2026.

**Where:** Additional mandatory OAuth security requirements apply to any Connected App or External Client App (ECA) that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs.

**When:** OAuth security requirements must be implemented for any CAs/ECAs by May 11, 2026.

**Why:** Additional mandatory OAuth security requirements consist of the following:

- Refresh Token IP Range Allow list: Restrict OAuth refresh tokens to known network locations by defining allowed IP ranges.
- Idle Refresh Token Time-to-Live (TTL): Sets a 30-day limit to the idle refresh token TTL, which is the amount of time a refresh token can be idle before it expires.

**How:** In your ECA or Connected App settings:

- Turn on **Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days**. In the app’s policies page, the Refresh Token Policy heading indicates that the idle TTL limit is enforced.
- Define allowed IP ranges and turn on **Enforce Refresh Token IP Allowlist**. The system then automatically validates the request IP against these stored ranges during the token exchange process.
- Self-attest. After all changes are implemented, partners must self-attest that the app is onboarded to these security controls and all relevant client changes are complete. After the attestation is made, the security controls are locked and can’t be disabled. ISVs are allowed to update the IP ranges in the Connected App or ECA configuration if needed. To self-attest and lock the security controls, click **Review Controls** at the top of the Connected App or ECA setup page. The Review Controls box is only available when at least one of the security controls is turned on.

#### See Also

- [_Salesforce Release Notes_: Limit the Idle Refresh Token TTL (Time-To-Live) to 30 Days](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_idle_refresh_token_ttl.htm&release=260&type=5 "Protect your data from unauthorized use of old, idle refresh tokens. For improved external client app and connected app security, set a 30-day limit to the idle refresh token TTL, which is the amount of time a refresh token can be inactive before it expires. The idle TTL works as a sliding window: each time the token is used within the 30-day period, its idle TTL resets.")
- [_Salesforce Release Notes_: Allow OAuth Refresh Tokens Only in Certain IP Ranges](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_identity_refresh_token_ip_allowlist.htm&release=260&type=5 "Secure your external client apps and connected apps by restricting OAuth refresh tokens to known network locations. This security enhancement ensures that refresh tokens are rejected if they originate from an IP address outside of your defined ranges. Your developers can now prevent unauthorized token use even if a valid token is compromised.")