---
schema_version: "1"
id: 41fb5ba43373b9e14a566e9f5863ba59631bcb68fbd577a399fbd099655d282b
title: New and Updated Security Alerts for OAuth Flows
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_connected_app_security_alerts.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_connected_app_security_alerts.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 22e6544624668796648a1d7ca9129a57113f96c882c0293c120527b027720f0c
description: To discourage users from connecting unfamiliar third-party apps to Salesforce, we added security alerts for OAuth flows. These security alerts appear when a user connects a device to Salesforce via the OAuth 2.0 device flow. We also updated the security alert on the page where users authorize access to their data via OAuth 2.0 flows.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# New and Updated Security Alerts for OAuth Flows

To discourage users from connecting unfamiliar third-party apps to Salesforce, we added security alerts for OAuth flows. These security alerts appear when a user connects a device to Salesforce via the OAuth 2.0 device flow. We also updated the security alert on the page where users authorize access to their data via OAuth 2.0 flows.

**Where:** This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in all editions.

**How:** During the device flow, users are prompted to enter a code from the device or app that they're connecting. We added a security alert to the page where users enter their code (1), to the page that indicates a successful connection (2), and to the page that indicates a denied connection (3).

![Device flow "Enter Code" page with new security alert](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/salesforce_release_notes/images/security/authorization_warnings.png)

We also updated the security alert on the page where users authorize an app to access their data via an OAuth flow.

![Security alert on the OAuth approval page where users authorize an app to access their data.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/salesforce_release_notes/images/security/allow_access.png)

If your external client app or connected app doesn't have a logo, Salesforce uses this default logo for the graphics above the warnings: ![Default app icon for OAuth pages](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/salesforce_release_notes/images/security/default_app_icon.png). To brand these graphics, update the Logo Image URL in your app settings.