All AppExchange Partners must follow new security requirements for Connected App (CA) and External Client App (ECA) solutions to ensure the highest level of trust and security for Customer Data. These requirements apply to any Connected App or External Client App that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs. These updates include mandatory Proof Key for Code Exchange (PKCE) and Refresh Token Rotation (RTR) enablement to prevent authorization code interception and token theft. Implementing these standards ensures these CAs or ECAs meet the latest Salesforce security protocols and safeguard Customer Data. Failure to comply may result in the Partner Application’s AppExchange de-listing and/or Salesforce’s temporary or permanent suspension of the Partner Application’s interoperation with Salesforce’s services.
Where: Any Connected App or External Client App that is included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs.
When: Mandatory security requirements must be implemented for any CAs/ECAs by May 11, 2026.
Why: Detailed security configurations like RTR and PKCE provide critical defense layers against threat actors.
How: For any Partner Applications with CAs or ECAs that are included or used in connection with a Partner Application, provided or created by the Partner, and in use by more than two customer production orgs, update your CA or ECA definitions to enable PKCE and Refresh Token Rotation within your app configurations and implement relevant changes in the client code.